Skip to content

🚨 Update go modules (main) (major) - #3133

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-major-go-modules
Open

🚨 Update go modules (main) (major)#3133
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-major-go-modules

Conversation

@renovate

@renovate renovate Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/MakeNowJust/heredoc v1.0.0 → v2.0.1 age adoption passing confidence
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 → v6.0.3 age adoption passing confidence
gopkg.in/go-jose/go-jose.v2 v2.6.3 → v4.1.4 age adoption passing confidence
helm.sh/helm/v3 v3.20.2 → v4.2.3 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

MakeNowJust/heredoc (github.com/MakeNowJust/heredoc)

v2.0.1

Compare Source

Version 2.0.1

Fixes

  • Correct import path for Go modules

v2.0.0

Compare Source

Version 2.0.0

Breaking Changes

  • Treats only white space (U+0020) and horizontal tabs (U+000D) as space characters. (#​6)
santhosh-tekuri/jsonschema (github.com/santhosh-tekuri/jsonschema/v5)

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

Bug Fixes:

  • fix/schema: field RecursiveRef misspelled
  • fix/schema: missing Deprecated field

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

v6.0.0

Compare Source

Improvements

  • mixed dialect support
  • custom $vocabulary support
  • sermver format
  • support for localisation for ValidationError
  • command jv
    • support stdin
    • --insecure and --cacert flag
    • --quiet flag

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

helm/helm (helm.sh/helm/v3)

v4.2.3: Helm v4.2.3

Compare Source

Helm v4.2.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v4.2.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7f (Terry Howe)

v4.2.2: Helm v4.2.2

Compare Source

Helm v4.2.2 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #​32214

Installation and Upgrading

Download Helm v4.2.2. The common platform binaries are here:

This release was signed by @​gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.3 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Revert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" b05881c (George Jenkins)

Full Changelog: helm/helm@v4.2.1...v4.2.2

v4.2.1: Helm v4.2.1

Compare Source

Helm v4.2.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #​31925
  • Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #​32056
  • Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #​31757
  • Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #​32081
  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #​32153
  • Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #​32128
  • Dependency updates

Installation and Upgrading

Download Helm v4.2.1. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • fix: protect FailingKubeClient.RecordedWaitOptions from data race (#​31925) d591a19 (Terry Howe)
  • fix: route registry client output to stdout instead of stderr (#​32056) 2a9fcae (Terry Howe)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 ffa5bd6 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 9f9dbaf (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 64a2891 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 e54a4a2 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 acb762b (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 768586d (dependabot[bot])
  • fix(version): avoid false range detection on prerelease x/X eabfae5 (Benoit Tigeot)
  • fix(version): version range || can has no space e3fd51f (Benoit Tigeot)
  • feat: report in debug the version we select with version range arg 1e47395 (Benoit Tigeot)
  • fix: prevent warning when using version range constraints a33e239 (Benoit Tigeot)
  • fix(kube): always propagate context.Canceled in WaitForDelete fa06d44 (Terry Howe)
  • fix(kube): prevent spurious early exit in WaitForDelete during informer sync 360d483 (Terry Howe)
  • chore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 7651edf (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 b132e7e (dependabot[bot])
  • fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 eee491a (Terry Howe)
  • chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 3e3c575 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 c4ce2bb (dependabot[bot])
  • chore(deps): bump actions/stale from 10.2.0 to 10.3.0 3892dc2 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 c4bbb62 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 a0d7f16 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 8a3de05 (dependabot[bot])
  • fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 57a4803 (Matheus Pimenta)
  • chore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1 b33ae02 (dependabot[bot])

Full Changelog: helm/helm@v4.2.0...v4.2.1

v4.2.0: Helm v4.2.0

Compare Source

Helm v4.2.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Switch to goreleaser for release builds
  • Kubernetes client libraries to v1.36
  • Add mustToToml template function
  • deprecate unused --hide-notes and --render-subchart-notes flags
  • --dry-run=server now respects generateName:

Installation and Upgrading

Download Helm v4.2.0. The common platform binaries are here:

This release was signed by @​gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.1 will contain only bug fixes
  • 4.3.0 is the next feature release

Changelog

  • Bump to version v4.2 0646808 (George Jenkins)
  • build: Clean up Goreleaser change (#​32098) e23bf3a (Scott Rigby)
  • fix: add -extldflags -static to dist target to match build-cross f60ab7c (Terry Howe)
  • build: use goreleaser build with manual archive creation 64aa46f (Terry Howe)
  • chore: remove build-cross dependency from test-acceptance d199a1a (Terry Howe)
  • ci: add fetch-depth 0 to canary checkout for goreleaser 8289940 (Terry Howe)
  • fix: address goreleaser build issues flagged in review c075022 (Terry Howe)
  • fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names 04885dd (Terry Howe)
  • fix: disable goreleaser checksums.txt and restrict zip to windows only 93103ce (Terry Howe)
  • fix: use index for optional env var in version_template e49a1dc (Terry Howe)
  • fix: canary build file names eaa0910 (Terry Howe)
  • Fix archive name 5a75279 (Terry Howe)
  • fix goreleaser archive 37284a9 (Terry Howe)
  • add support for loong64 45336cc (Terry Howe)
  • fix artifact directory a9659b0 (Terry Howe)
  • update configuration to v2 e368f17 (Terry Howe)
  • remove GOTOOLCHAIN e7bea85 (Terry Howe)
  • chore: replace mitchellh/gox with goreleaser 075c096 (Terry Howe)
  • chore(deps): bump github.com/distribution/distribution/v3 12f2c41 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 58e8ffd (dependabot[bot])
  • chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 e61bbfb (dependabot[bot])
  • Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6df (Matheus Pimenta)
  • fix: adds topLevel permissions to improve openSSF scores 277d970 (Gagan H R)
  • Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7 (Matheus Pimenta)
  • fix(templating): hooks conflicting with templates in post-renderers (#​32049) 8f56f24 (Matheus Pimenta)
  • docs: fix grammar and spacing in CONTRIBUTING.md db40adb (Mohit)
  • chore(deps): bump the k8s-io group with 7 updates 775e794 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 934ace3 (dependabot[bot])
  • fix(templating): SplitManifests must preserve line endings for downstream YAML parsers (#​31952) 265c5eb (Matheus Pimenta)
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 48e2b7d (dependabot[bot])
  • Update pkg/chart/common/util/coalesce.go a8e2497 (Evans Mungai)
  • test(values): Add test for nil cleanup in partially overridden subchart maps 52fc971 (Johannes Lohmer)
  • fix(values): do not copy chart-default nils into coalesced values 0063877 (Johannes Lohmer)
  • test(values): add test for subchart nil producing %!s() 6eb4ebf (Johannes Lohmer)
  • test(values): add tests for subchart nil value regressions 5cb4e7d (Johannes Lohmer)
  • chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 b5c7c80 (dependabot[bot])
  • fix(templating): fix wrong YAML separator parsing for post-renderers (#​31941) a27f1ad (Matheus Pimenta)
  • fix: add debug logging to HTTP getter for helm pull c26be60 (Cairon)
  • chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 953f5f0 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0 10fc5f3 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0 d89e7c6 (dependabot[bot])
  • chore: Update release notes script for Helm v4 8a95461 (George Jenkins)
  • refactor(cli): share RetryingRoundTripper via pkg/kubeenv 213c869 (Sumit Solanki)
  • chore(deps): bump github.com/lib/pq from 1.12.2 to 1.12.3 bd5027a (dependabot[bot])
  • fix: unnecessary-format lint issues from merge 087736b (George Jenkins)
  • fix: Plugin missing provenance bypass 586eb57 (George Jenkins)
  • chore(deps): bump github.com/fluxcd/cli-utils c8c5dfa (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 998466c (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp b0cec58 (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 6ebfb29 (dependabot[bot])
  • test(kube): fix flaky WaitForDelete test by avoiding informer sync race a7f8443 (Terry Howe)
  • test(kube): fix flaky WaitForDelete timing in status wait tests 4c0d21f (Terry Howe)
  • chore(deps): bump github.com/distribution/distribution/v3 08dea9c (dependabot[bot])
  • Minor nit: fix import instructions to comply with canonical import paths de58531 (Anmol Virdi)
  • chore(deps): bump github.com/distribution/distribution/v3 9b1ad4c (dependabot[bot])
  • fix(action): return correct error variable in prepareUpgrade 8ef2d45 (Rhys McNeill)
  • chore(deps): bump github.com/lib/pq from 1.12.1 to 1.12.2 cd7cf76 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.30.7 to 4.35.1 45ee55b (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.12.0 to 1.12.1 9a06741 (dependabot[bot])
  • chore(deps): bump actions/setup-go from 6.2.0 to 6.4.0 d1e31ca (dependabot[bot])
  • fix(kube): clarify server-side apply patch errors f257c95 (abhay1999)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 7025480 (Terry Howe)
  • refactor(cli): decouple EnvSettings from pkg/kube 64f1d0a (Sumit Solanki)
  • docs(registry): fix incorrect and improve clarity of comments in client.go 85bf56e (Debasish Mohanty)
  • refactor(cli): decouple EnvSettings from pkg/kube to avoid import cycles 1549937 (Sumit Solanki)
  • chore(deps): bump github.com/ProtonMail/go-crypto from 1.3.0 to 1.4.1 c7a75b1 (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.0 3a7573a (dependabot[bot])
  • chore(deps): bump github.com/fatih/color from 1.18.0 to 1.19.0 0229da1 (dependabot[bot])
  • docs(engine): fix misleading toTOML doc comment c1a5a6e (Ilya Kiselev)
  • feat(engine): add mustToToml template function b075f7a (Ilya Kiselev)
  • chore: fix unnecessary-format issues from revive 7edfff3 (Matthieu MOREL)
  • chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 37185d2 (dependabot[bot])
  • chore: fix bool-compare issues from testifylint 071558d (Matthieu MOREL)
  • chore: enable perfsprint linter 6249489 (Matthieu MOREL)
  • ignore error plugin loads (cli, getter) 47a0840 (George Jenkins)
  • chore(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0 3d06fd1 (dependabot[bot])
  • fix(kube): remove legacy import comments from test files e64d628 (Terry Howe)
  • pkg/kube: remove legacy import comments d7cdc9e (abhay1999)
  • fix: Plugin version path traversal 36dcc27 (George Jenkins)
  • chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0 c4be7af (dependabot[bot])
  • chore: fix some minor issues in the comments 259f181 (tsinglua)
  • fix: Chart dot-name path bug 6018499 (George Jenkins)
  • chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.1 to 0.23.3 74e7cf8 (dependabot[bot])
  • fix: insert newline after doc separators glued to content by template trimming af94abf (Matheus Pimenta)
  • chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 16073b1 (dependabot[bot])
  • chore: enable modernize linter (#​31860) e31a078 (Matthieu MOREL)
  • Restored --atomic flag on install command 16573f8 (Travis Leeden)
  • fix: bump go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394 b550ce9 (Terry Howe)
  • fix: bump fluxcd/cli-utils to v0.37.2-flux.1 1dfa77e (Terry Howe)
  • Update pkg/cmd/status.go 5d40f17 (Matthieu MOREL)
  • chore(internal): enable perfsprint linter (#​31871) d4f6193 (Matthieu MOREL)
  • chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 82d9bed (dependabot[bot])
  • chore(pkg): fix perfsprint linter issues part 6 dc0e3f1 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter e3c74fd (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 1d2d63c (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 63f03c0 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter c25c988 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 0fecfd0 (Matthieu MOREL)
  • chore(internal): enable perfsprint linter 6524162 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 6c2cb2f (Matthieu MOREL)
  • chore(internal): enable perfsprint linter 9409226 (Matthieu MOREL)
  • Replace unneeded use of t.Fatalf with t.Fatal 36cb3a2 (Mads Jensen)
  • fix: enable nolinlint linter 5b6c6bb (Matthieu MOREL)
  • fixup strings.Cut variables b667317 (George Jenkins)
  • chore: Improve AGENTS.md 956c724 (George Jenkins)
  • chore: fixes 92b64e8 (George Jenkins)
  • fix: correct import comment in statuswait.go from v3 to v4 c59c140 (rohansood10)
  • fix: handle OCI digest algorithm prefix in chart downloader (#​31601) ee01860 (Evans Mungai)
  • chore(deps): bump actions/stale from 10.1.1 to 10.2.0 304d25f (dependabot[bot])
  • chore(deps): bump the k8s-io group with 7 updates 0b13436 (dependabot[bot])
  • feat(release): add internal/release/v2 package for chart v3 support (#​31709) 4a91f3a (Evans Mungai)
  • chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 7823853 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0 aec7ace (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.11.1 to 1.11.2 a23b638 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.33.0 to 0.34.0 5cddc95 (dependabot[bot])
  • chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.21.0 to 0.21.1 2e266c3 (dependabot[bot])
  • fix(pkg): errorlint linter 259f76a (Matthieu MOREL)
  • fix(internal): errorlint linter 0254182 (Matthieu MOREL)
  • fix(pkg): errorlint linter 6d1490e (Matthieu MOREL)
  • fix(pkg): errorlint linter 4d0ae7f (Matthieu MOREL)
  • fix(internal): errorlint linter abecafa (Matthieu MOREL)
  • fix(pkg): errorlint linter 4330bde (Matthieu MOREL)
  • fix(pkg): errorlint linter c8989d9 (Matthieu MOREL)
  • fix(cmd): errorlint linter edbd705 (Matthieu MOREL)
  • chore: new KEYS entry for George Jenkins 5638c35 (George Jenkins)
  • fix(downloader): safely handle concurrent file writes on Windows 76eb37c (Orgad Shaneh)
  • fix(install): check nil for restClientGetter and fix tests 9817a68 (Manuel Alonso)
  • feat(create): add --chart-api-version flag (when HELM_EXPERIMENTAL_CHART_V3 env var is set) (#​31592) 5aac320 (Evans Mungai)
  • chore(pkg): fix modernize linter 0d75d86 (Matthieu MOREL)
  • chore(internal): fix modernize linter 859292e (Matthieu MOREL)
  • chore(pkg): fix modernize linter 5cc2e55 (Matthieu MOREL)
  • chore(pkg): fix modernize linter ba38159 (Matthieu MOREL)
  • chore(internal): fix modernize linter e2d184c (Matthieu MOREL)
  • chore(pkg): fix modernize linter 111d4e6 (Matthieu MOREL)
  • add image index test e8f386b (Pedro Tôrres)
  • fix pulling charts from OCI indices d983696 (Pedro Tôrres)
  • chore(deps): bump github.com/lib/pq from 1.10.9 to 1.11.1 9c9c3a6 (dependabot[bot])
  • Revert "Consider GroupVersionKind when matching resources" 787b61c (Matheus Pimenta)
  • chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.0 to 0.23.1 becf9bf (dependabot[bot])
  • fix(template): deprecate unused --hide-notes and --render-subchart-notes flags 6d5f56f (Scott Rigby)
  • chore(deps): bump github.com/fluxcd/cli-utils b53198e (dependabot[bot])
  • chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 b59e533 (dependabot[bot])
  • whitespace ec07265 (Austin Abro)
  • fix(copystructure): handle nil elements in slice copying e3829eb (Philipp Born)
  • use logger with waiter 63b40a7 (Austin Abro)
  • feat(kstatus): fine-grained context options for waiting b0b35f1 (Matheus Pimenta)
  • Apply suggestions from code review 26e28e8 (George Jenkins)
  • Remove legacy sync-repo.sh script 97fd007 (Jeevan Yewale)
  • chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.0 5262007 (dependabot[bot])
  • docs: document uninstall using cascade foreground flag e70d59d (Evans Mungai)
  • bugfix(kstatus): do not wait forever on failed resources bbec77c (Matheus Pimenta)
  • Modernize Helm v3 CONTRIBUTING.md 443a2a6 (George Jenkins)
  • chore(defaults): server-side apply SDK defaults should always match the CLI defaults c1cc625 (Matheus Pimenta)
  • chore: clarify --wait flag help text 828038a (Evans Mungai)
  • chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 e223771 (dependabot[bot])
  • chore(refactor): better testing and functionality for installing crd 6501ef4 (Manuel Alonso)
  • bugfix(storage): fix storage not getting logger from driver a8eb527 (Matheus Pimenta)
  • chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 da1d68a (dependabot[bot])
  • fix(test): fix tests and check nil for restclient 0f949a9 (Manuel Alonso)
  • fix(test): merge fix correctly 561410a (Manuel Alonso Gonzalez)
  • Remove refactorring changes from coalesce_test.go 0298b2f (Evans Mungai)
  • Fix import b8937ad (Evans Mungai)
  • Update pkg/chart/common/util/coalesce_test.go a333bba (Evans Mungai)
  • Fix rollback for missing resources 374aeb4 (Feruzjon Muyassarov)
  • fix(install): add more tests and check nil file data 00f0a48 (Manuel Alonso)
  • fix(test): no check empty resources 0357e8d (Manuel Alonso)
  • fix(install): check lenght and file nil, add tests 52235cc (Manuel Alonso)
  • fix(action): crd resources can be empty [268593b](https://redirect.github.com/helm/helm/

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 3061ab1 to ad5b351 Compare February 27, 2026 09:54
@renovate

renovate Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum
Command failed: go get -t ./...
go: gopkg.in/go-jose/go-jose.v4@v4.1.4: parsing go.mod:
	module declares its path as: github.com/go-jose/go-jose/v4
	        but was required as: gopkg.in/go-jose/go-jose.v4

@github-actions github-actions Bot added size: L and removed size: S labels Feb 27, 2026
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 7 times, most recently from 55a7196 to ca1e8bd Compare March 12, 2026 12:48
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 3 times, most recently from 4ddfa54 to 6a6166b Compare March 18, 2026 09:16
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 3 times, most recently from 8eb3e76 to f1aa247 Compare March 26, 2026 13:42
@github-actions github-actions Bot added size: XS and removed size: L labels Mar 26, 2026
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 2 times, most recently from 7c8ec28 to 2b721f7 Compare April 1, 2026 17:17
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 2 times, most recently from 2be196d to 458ca5f Compare April 10, 2026 21:58
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 458ca5f to 61bcaeb Compare April 16, 2026 19:20
@fullsend-ai-review

fullsend-ai-review Bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:34 PM UTC · Completed 8:44 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Review

Findings

High

  • [api-contract] acceptance/go.mod:38 — The PR replaces gopkg.in/go-jose/go-jose.v2 with gopkg.in/go-jose/go-jose.v4 in acceptance/go.mod, but acceptance/image/image.go line 60 still imports gopkg.in/go-jose/go-jose.v2/json. In Go modules, .v2 and .v4 are distinct module paths. Removing v2 from go.mod while source code still imports it will cause a build failure unless v2 is pulled in transitively by another dependency. No source file has been updated to use v4.
    Remediation: Either update acceptance/image/image.go to import gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility) and keep v4 in go.mod, or keep v2 in go.mod until the source code is migrated. Run go mod tidy to verify.

Medium

  • [logic-error] go.mod:8 — The PR adds github.com/MakeNowJust/heredoc/v2 as a direct dependency, but all 19 Go source files still import github.com/MakeNowJust/heredoc (the v1 path). The v2 direct dependency is unused by any source code and will be removed by go mod tidy. Note: heredoc v1 remains a direct dependency in the second require block (no // indirect comment), so the build will not break — the v2 entry is simply extraneous.
    Remediation: Either update all 19 Go files to import heredoc/v2 (after verifying API compatibility), or remove heredoc/v2 from go.mod.

  • [logic-error] go.mod:32 — The PR adds github.com/santhosh-tekuri/jsonschema/v6 as a direct dependency, but all 3 Go source files still import jsonschema/v5. The v6 direct dependency is unused and will be removed by go mod tidy. Note: jsonschema/v5 remains a direct dependency in the second require block (no // indirect comment), so the build will not break.
    Remediation: Either update the 3 Go files to import jsonschema/v6 and adapt to the v6 API, or remove jsonschema/v6 from go.mod.

  • [logic-error] tools/go.mod:15 — The PR adds helm.sh/helm/v4 v4.2.3 as a new direct dependency alongside helm.sh/helm/v3. However, tools/tools.go only imports helm.sh/helm/v3/cmd/helm (line 29). No source file imports helm.sh/helm/v4. The v4 dependency is unused and will be pruned by go mod tidy.
    Remediation: Either update tools/tools.go to import helm.sh/helm/v4/cmd/helm, or remove helm.sh/helm/v4 from tools/go.mod.

Low

  • [stale-reference] go.sum — The go.sum changes show heredoc/v2 and jsonschema/v6 entries with only /go.mod checksums (no source archive pair), confirming these modules are declared in go.mod but never imported by source code. Running go mod tidy will clean up both go.mod and go.sum.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run

Review

Findings

Critical

  • [build failure] acceptance/go.mod:38 — The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4, but acceptance/image/image.go:60 still imports "gopkg.in/go-jose/go-jose.v2/json". In Go modules, .v2 and .v4 are entirely separate module paths. Since .v2 is completely removed from acceptance/go.mod (not demoted to indirect), this will cause a compilation failure.
    Remediation: Either update acceptance/image/image.go to import the v4 module path and adapt to API changes, or retain gopkg.in/go-jose/go-jose.v2 alongside .v4.

High

  • [dependency/import mismatch] go.mod:32 — github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 is declared as a direct dependency, but all 3 source files (internal/policy/policy.go, internal/evaluation_target/application_snapshot_image/application_snapshot_image.go, pkg/schema/schema.go) still import jsonschema/v5. No source file imports jsonschema/v6. The v6 dependency is phantom, and go mod tidy would remove it. The v5→v6 upgrade involves significant API changes that require source code migration.
    Remediation: Update all 3 source files to import jsonschema/v6, adapt to API changes, then run go mod tidy.

Medium

  • [dependency/import mismatch] go.mod:8 — github.com/MakeNowJust/heredoc/v2 v2.0.1 is declared as a direct dependency, but all 19 source files still import "github.com/MakeNowJust/heredoc" (the v1 path). The v2 dependency is unused and go mod tidy would remove it, reverting the intended upgrade.
    Remediation: Update all 19 source files to import heredoc/v2, then run go mod tidy.

  • [unused dependency] tools/go.mod:14 — helm.sh/helm/v4 v4.2.3 is added as a direct dependency, but tools/tools.go only imports "helm.sh/helm/v3/cmd/helm". No source file imports helm/v4. The dependency is unused and go mod tidy would remove it.
    Remediation: Either update tools/tools.go to import helm.sh/helm/v4/cmd/helm, or remove helm.sh/helm/v4 from tools/go.mod.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (2)

Review

Findings

High

  • [logic error] go.mod:8 — The PR promotes github.com/MakeNowJust/heredoc/v2 v2.0.1 to a direct dependency and demotes heredoc v1.0.0 to indirect, but all 19 Go source files still import the v1 path ("github.com/MakeNowJust/heredoc"). The v2 module is declared as direct but entirely unused by source code. Similarly, github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 is declared as direct, but all 3 source files importing this library use the v5 import path. Both v1/v5 are retained as indirect so the code still compiles, but running go mod tidy would reverse these go.mod changes since the new major versions are not referenced by any Go source. The PR does not accomplish its stated upgrade goal for these two libraries.
    Remediation: Either (a) update all Go source files to use the new import paths (heredoc/v2, jsonschema/v6) and adapt to any API changes from the major version bumps, or (b) revert the go.mod changes for these two libraries since without source code changes the upgrade has no effect.

  • [logic error] acceptance/go.mod:38 — The acceptance module replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4 as a direct dependency, but acceptance/image/image.go:60 still imports "gopkg.in/go-jose/go-jose.v2/json". Unlike the main module’s heredoc/jsonschema changes, go-jose.v2 is NOT retained as an indirect dependency in acceptance/go.mod. If no transitive dependency pulls in go-jose.v2, this will cause a build failure for the acceptance tests. Even if v2 is transitively available, the upgrade provides no security benefit since the source code continues to use the v2 module. If the intent is to remediate CVE GHSA-78h2-9frx-2jm8 and GHSA-c6gw-w398-hv78, the source import must also be updated to use the v4 module path.
    Remediation: Update acceptance/image/image.go to import from gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility and updating any Parse function calls to specify expected algorithms per the v4 API), or retain .v2 in acceptance/go.mod until the source is migrated.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (3)

Review

Findings

Critical

  • [build-failure] acceptance/go.mod:38 — The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4 in acceptance/go.mod, but acceptance/image/image.go (line 60) still imports gopkg.in/go-jose/go-jose.v2/json. Since .v2 is completely removed from the acceptance module's go.mod (no indirect entry remains), the acceptance module will fail to build with an unresolved import error. This also leaves the security vulnerabilities in go-jose v2 (GHSA-78h2-9frx-2jm8, GHSA-c6gw-w398-hv78) unaddressed since the source code still depends on the v2 API.
    Remediation: Either (1) keep gopkg.in/go-jose/go-jose.v2 v2.6.3 in acceptance/go.mod until source code is migrated, or (2) update the import in acceptance/image/image.go from gopkg.in/go-jose/go-jose.v2/json to the v4 equivalent and verify API compatibility, then run go mod tidy.

Medium

  • [unused-dependency] go.mod — The PR adds github.com/MakeNowJust/heredoc/v2 v2.0.1 and github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 as direct dependencies, but no Go source file imports these new module paths (19 files import heredoc v1, 3 files import jsonschema/v5, 0 files import v2 or v6). The old versions are retained in a second require block so the build won't break, but the new entries are dead weight that go mod tidy would remove.
    Remediation: Either update all source files to use the new import paths and adapt to API changes, or do not add the v2/v6 entries until source code migration is ready.

Low

  • [api-contract] go.mod — This PR bumps three dependencies by major version (heredoc v1→2, jsonschema v5→6, go-jose v2→4) but includes zero source code changes. For the root module, the old versions are retained so no breakage occurs, but the new versions serve no purpose. For the acceptance module, the old version is removed, causing the build failure above.

  • [scope-authorization] — Renovate's automated major version bump strategy does not handle Go modules correctly because Go's import path convention requires source code changes alongside go.mod changes. Consider configuring Renovate to set major Go module updates to manual-only or to flag them for manual intervention.

Previous run (4)

Review

This Renovate PR updates go.mod declarations for three Go modules to new major versions, but does not update the corresponding import paths in Go source code. In Go, major version bumps produce distinct module paths (e.g., /v5 → /v6), so source code must be updated alongside go.mod for the upgrade to take effect.

Findings

Critical

  • [api-contract] acceptance/go.mod — The gopkg.in/go-jose/go-jose.v2 dependency is replaced by .v4, but acceptance/image/image.go still imports gopkg.in/go-jose/go-jose.v2/json. Unlike the other two modules, .v2 is not retained as an indirect dependency, so this change will break the build of the acceptance module.
    Remediation: Update acceptance/image/image.go to import gopkg.in/go-jose/go-jose.v4/json (verify the v4 package exposes the same json sub-package), or revert the go.mod change.

High

  • [api-contract] go.mod — github.com/MakeNowJust/heredoc/v2 v2.0.1 is declared as a direct dependency, but all 19 Go files that use heredoc still import the v1 path ("github.com/MakeNowJust/heredoc"). The old v1 is retained as indirect, so the build won't break — but the v2 upgrade has no effect. The go.sum confirms v2 was never downloaded (only a /go.mod hash, no h1: package hash).
    Remediation: Update all 19 import statements to "github.com/MakeNowJust/heredoc/v2", adapt to any API changes, and remove the indirect v1 entry — or revert the go.mod change.

  • [api-contract] go.mod — github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 is declared as a direct dependency, but 3 Go files (pkg/schema/schema.go, internal/policy/policy.go, internal/evaluation_target/application_snapshot_image/application_snapshot_image.go) still import jsonschema/v5. The old v5 is retained as indirect, so the build won't break — but the v6 upgrade has no effect. The v6 API has breaking changes (see the migration guide).
    Remediation: Update the 3 import statements to "github.com/santhosh-tekuri/jsonschema/v6", adapt to v6 API changes, and remove the indirect v5 entry — or revert the go.mod change.

Previous run (5)

Review — 🔴 Changes Requested

PR: #3133 — 🚨 Update go modules (main) (major)
Author: renovate[bot]
Verdict: request-changes

Summary

This Renovate-generated PR bumps three Go module dependencies to new major versions:

  • github.com/MakeNowJust/heredoc v1.0.0 → v2.0.1
  • github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 → v6.0.2
  • gopkg.in/go-jose/go-jose.v2 v2.6.3 → v4.1.4

However, the PR only modifies go.mod and go.sum files without updating any Go source code import paths. In Go, major version bumps change the module path (e.g., jsonschema/v5 → jsonschema/v6), and all import statements in source files must be updated accordingly. This is a fundamental requirement of Go module semantics — the PR in its current form does not achieve the intended upgrade.

Findings

1. 🔴 Source code imports not updated — heredoc (19 files)

The PR adds github.com/MakeNowJust/heredoc/v2 v2.0.1 as a direct dependency but preserves heredoc v1.0.0 in a secondary require block. All 19 source files still import the v1 path (github.com/MakeNowJust/heredoc), so the v2 module is completely unused. Running go mod tidy would remove it.

Affected files:

  • cmd/inspect/inspect_policy.go, cmd/inspect/inspect_policy_data.go, cmd/track/track_bundle.go, cmd/fetch/fetch_policy.go
  • cmd/validate/image.go, cmd/validate/image_test.go, cmd/validate/policy.go, cmd/validate/input.go, cmd/validate/vsa.go
  • cmd/root/root_cmd.go, cmd/initialize/init_policies.go, cmd/sigstore/initialize.go
  • internal/evaluator/conftest_evaluator_unit_metadata_test.go, internal/opa/rule/rule_test.go
  • internal/evaluator/conftest_evaluator_test_helpers.go, internal/opa/output_test.go, internal/opa/inspect_test.go
  • internal/policy/policy_test.go, internal/tracker/tracker_test.go

Remediation: Update all import paths from github.com/MakeNowJust/heredoc to github.com/MakeNowJust/heredoc/v2, verify API compatibility (v2 changes whitespace handling — only U+0020 and U+000D are treated as space), then remove the v1 require.

2. 🔴 Source code imports not updated — jsonschema (3 files)

The PR adds github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 as a direct dependency but preserves jsonschema/v5 v5.3.1. All 3 source files still import the v5 path, and the code uses v5-specific APIs (NewCompiler(), CompileString(), AddResource(), AssertFormat, *jsonschema.ValidationError). The v6 module is unused.

Affected files:

  • pkg/schema/schema.go — uses jsonschema.NewCompiler(), compiler.AddResource(), compiler.AssertFormat, compiler.MustCompile()
  • internal/policy/policy.go — uses jsonschema.CompileString()
  • internal/evaluation_target/application_snapshot_image/application_snapshot_image.go — uses *jsonschema.Schema, *jsonschema.ValidationError

Remediation: Update import paths from jsonschema/v5 to jsonschema/v6, then address the v5→v6 migration guide. The v6 API has breaking changes to compiler initialization and schema compilation methods.

3. 🔴 go-jose v2→v4 in acceptance module — potential build breakage

The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4 in acceptance/go.mod, but:

  • acceptance/image/image.go:60 still imports gopkg.in/go-jose/go-jose.v2/json
  • acceptance/go.sum is not updated to include checksums for go-jose.v4
  • Unlike the root module changes, the old v2 is not preserved as an indirect dependency

If go-jose.v2 is not available as a transitive dependency of another module, this will cause a build failure. Even if it is transitively available, the explicit dependency declaration mismatch makes the intent unclear.

Remediation: Update the import in acceptance/image/image.go from gopkg.in/go-jose/go-jose.v2/json to the v4 equivalent, update acceptance/go.sum, and verify API compatibility (go-jose v4 has significant changes to JSON handling and JWE).

Root Cause

This is a known limitation of Renovate with Go major version updates. Renovate can bump version declarations in go.mod but cannot rewrite Go import paths in source code. Major version updates in Go require both go.mod changes and source code import path updates, making them inherently a manual task.

Recommendation

This PR should not be merged as-is. The options are:

  1. Close this PR and create a manual branch that performs the full migration (update imports, handle API breaking changes, run tests)
  2. Use this PR as a starting point — update source imports, address API changes, update go.sum, run go mod tidy, and verify all tests pass
Previous run (6)

Review — request-changes

Summary

This Renovate bot PR proposes three major Go dependency version bumps but only modifies go.mod / go.sum files without updating any source code import paths. In Go's module system, major versions v2+ require distinct import paths (e.g., module/v2 vs module). Because no .go files were changed, the new major versions are declared but completely unused — the code continues compiling against the old versions. All three upgrades are no-ops.

Findings

1. ⛔ go.mod — heredoc v1→v2 import paths not updated (high)

The PR promotes github.com/MakeNowJust/heredoc from v1.0.0 to github.com/MakeNowJust/heredoc/v2 v2.0.1 as a direct dependency, while adding the old v1.0.0 back as indirect. However, 19 .go files still import github.com/MakeNowJust/heredoc (the v1 path). The v2 module is declared but never imported — running go mod tidy would remove it.

Files affected: cmd/inspect/inspect_policy.go, cmd/inspect/inspect_policy_data.go, cmd/root/root_cmd.go, cmd/sigstore/initialize.go, cmd/initialize/init_policies.go, cmd/track/track_bundle.go, cmd/fetch/fetch_policy.go, cmd/validate/image.go, cmd/validate/image_test.go, cmd/validate/policy.go, cmd/validate/input.go, cmd/validate/vsa.go, and 7 files in internal/.

Remediation: Update all 19 import paths to github.com/MakeNowJust/heredoc/v2 and verify API compatibility (the Doc function signature is unchanged in v2), or revert the go.mod change.

2. ⛔ go.mod — jsonschema v5→v6 import paths not updated (high)

Same pattern: github.com/santhosh-tekuri/jsonschema/v5 is bumped to v6 in go.mod but 3 .go files still import the v5 path (pkg/schema/schema.go, internal/evaluation_target/application_snapshot_image/application_snapshot_image.go, internal/policy/policy.go). The v6 module is unused.

Additionally, jsonschema v6 has significant breaking API changes: CompileString() was removed, NewCompiler() returns a different type, Compiler.AssertFormat and Compiler.AddResource() signatures changed, and Schema.Validate() takes different parameters. Migration to v6 requires code rewrites beyond just changing import paths.

Remediation: Either undertake the full v6 migration (import paths + API changes) or revert the go.mod change. Given the scope of API changes, this should be a separate, dedicated PR.

3. ⛔ acceptance/go.mod — go-jose v2→v4 import path not updated (high)

The PR changes gopkg.in/go-jose/go-jose.v2 to .v4 in acceptance/go.mod, but acceptance/image/image.go:60 still imports gopkg.in/go-jose/go-jose.v2/json. The old v2 is removed as a direct dependency. If v2 is not available as a transitive dependency, the build will fail. If it remains transitively available, the upgrade is a no-op.

Furthermore, go-jose v4 removed the json sub-package entirely. Migrating to v4 requires replacing the import with standard library encoding/json.

Remediation: Update acceptance/image/image.go to use encoding/json instead of gopkg.in/go-jose/go-jose.v2/json, then remove v2 from the dependency tree.

4. ⛔ go-jose v2 CVEs remain unresolved (high)

go-jose v2 has known CVEs (CVE-2023-50658: DoS via p2c header in JWE; CVE-2024-28180: decompression bomb in JWE). This PR does not remediate them because the code still imports and compiles against go-jose v2. The go.mod change is security theater — the vulnerable module remains in the compiled binary.

Remediation: Migrate the source code away from go-jose v2 to actually remove the vulnerable dependency from the module graph.

5. go.sum — new modules have no content hashes (medium)

The new versions (heredoc/v2, jsonschema/v6) only have /go.mod hash entries in go.sum, not h1: content hashes. This independently confirms that no Go source code imports these modules — the Go toolchain only fetched their go.mod for dependency resolution but never downloaded the source.

Verdict

This PR should not be merged in its current state. All three major version bumps are no-ops because the source code import paths were not updated. The dependencies continue to resolve against the old versions. This is a known limitation of Renovate bot with Go major version bumps — Renovate updates go.mod but cannot rewrite .go import paths.

Recommended approach:

  • Close this PR and create separate, manual PRs for each major version migration that include the necessary source code changes
  • Or configure Renovate to skip major Go module bumps (set "major": { "enabled": false } for Go managers)
Previous run (7)

Review

Findings

Critical

  • [api-contract] acceptance/go.mod:38 — The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4, but acceptance/image/image.go (line 60) still imports gopkg.in/go-jose/go-jose.v2/json. In Go, v2 and v4 are distinct module paths. Removing v2 from go.mod while no source file imports the v4 path means the acceptance module will not compile — the v2 import cannot resolve without a declared v2 dependency, and v4 is an unused dependency.
    Remediation: Either update the import in acceptance/image/image.go from gopkg.in/go-jose/go-jose.v2/json to the v4 equivalent (the canonical v4 path is github.com/go-jose/go-jose/v4), or keep v2 as a dependency alongside v4.

High

  • [incomplete-security-fix] acceptance/go.mod:38 — The stated purpose of upgrading go-jose is to address GHSA-78h2-9frx-2jm8 (JWE decryption panic) and GHSA-c6gw-w398-hv78 (unbounded splits), but acceptance/image/image.go still imports from the v2 module path. The security fixes in v4 will NOT apply to code importing v2. If go mod tidy re-adds v2 as an indirect dependency, the vulnerable version remains linked into the binary. See also: [api-contract] finding at this location.
    Remediation: Update the import in acceptance/image/image.go to use the v4 module path and adapt to API changes, then run go mod tidy to ensure v2 is fully removed from the dependency graph.

Medium

  • [logic-error] go.mod:8 — github.com/MakeNowJust/heredoc/v2 v2.0.1 is promoted to a direct dependency, but no Go source file imports this v2 path. All 19 files using heredoc import github.com/MakeNowJust/heredoc (v1). The v1 module is retained in a secondary require block so the code compiles, but v2 is entirely unused — go.sum only contains the /go.mod hash for v2, confirming no source was downloaded.
    Remediation: Either update all 19 source files to import github.com/MakeNowJust/heredoc/v2 (verify API compatibility — v2 changes whitespace handling), or remove the v2 entry from go.mod.

  • [logic-error] go.mod:32 — github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 is promoted to a direct dependency, but no Go source file imports the v6 path. All 3 files using jsonschema import github.com/santhosh-tekuri/jsonschema/v5. The v5 module is retained so the code compiles, but v6 is unused. The v5→v6 migration involves breaking API changes (mixed dialect support, vocabulary support, localization) that require source code adaptation.
    Remediation: Either update the 3 source files (pkg/schema/schema.go, internal/policy/policy.go, internal/evaluation_target/application_snapshot_image/application_snapshot_image.go) to import v6 and adapt to the new API, or remove the v6 entry from go.mod.

Labels: PR modifies Go module dependencies across go.mod and go.sum files.

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 26, 2026
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from b5766ef to 7214fc8 Compare July 12, 2026 10:59
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 11:00 AM UTC · Completed 11:08 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 7214fc8 to 0a97da2 Compare July 14, 2026 20:03
fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 14, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:04 PM UTC · Completed 8:09 PM UTC
Commit: 87c4a29 · View workflow run →

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 0a97da2 to 37d83e9 Compare July 21, 2026 01:11
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:12 AM UTC · Completed 1:24 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 37d83e9 to d6abb5d Compare July 22, 2026 13:50
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:51 PM UTC · Completed 2:07 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from d6abb5d to ef0a8d0 Compare July 31, 2026 20:16
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 31, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:17 PM UTC · Completed 8:31 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from ef0a8d0 to 1f34e8c Compare August 4, 2026 11:50
@github-actions github-actions Bot added size: M and removed size: XS labels Aug 4, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 11:51 AM UTC · Completed 12:04 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 1f34e8c to 8dbb0b6 Compare August 6, 2026 15:50
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 8dbb0b6 to e59397d Compare August 11, 2026 16:58
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 4:59 PM UTC · Completed 5:13 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]
fullsend-ai-review Bot suggested changes Aug 11, 2026
View reviewed changes

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread acceptance/go.mod
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
golang.org/x/sync v0.22.0
gopkg.in/go-jose/go-jose.v2 v2.6.3
gopkg.in/go-jose/go-jose.v4 v4.1.4

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] api-contract

The PR replaces gopkg.in/go-jose/go-jose.v2 with gopkg.in/go-jose/go-jose.v4 in acceptance/go.mod, but acceptance/image/image.go line 60 still imports gopkg.in/go-jose/go-jose.v2/json. In Go modules, .v2 and .v4 are distinct module paths. Removing v2 from go.mod while source code still imports it will cause a build failure unless v2 is pulled in transitively. No source file has been updated to use v4.

Suggested fix: Either update acceptance/image/image.go to import gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility) and keep v4 in go.mod, or keep v2 in go.mod until the source code is migrated. Run go mod tidy to verify.

Comment thread go.mod
cuelang.org/go v0.16.0
github.com/CycloneDX/cyclonedx-go v0.10.0
github.com/MakeNowJust/heredoc v1.0.0
github.com/MakeNowJust/heredoc/v2 v2.0.1

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] logic-error

The PR adds github.com/MakeNowJust/heredoc/v2 as a direct dependency, but all 19 Go source files still import github.com/MakeNowJust/heredoc (the v1 path). The v2 direct dependency is unused by any source code and will be removed by go mod tidy. heredoc v1 remains a direct dependency in the second require block, so the build will not break.

Suggested fix: Either update all 19 Go files to import heredoc/v2 (after verifying API compatibility), or remove heredoc/v2 from go.mod.

Comment thread go.mod
github.com/package-url/packageurl-go v0.1.3
github.com/qri-io/jsonpointer v0.1.1
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] logic-error

The PR adds github.com/santhosh-tekuri/jsonschema/v6 as a direct dependency, but all 3 Go source files still import jsonschema/v5. The v6 direct dependency is unused and will be removed by go mod tidy. jsonschema/v5 remains a direct dependency in the second require block, so the build will not break.

Suggested fix: Either update the 3 Go files to import jsonschema/v6 and adapt to the v6 API, or remove jsonschema/v6 from go.mod.

Comment thread tools/go.mod
gotest.tools/gotestsum v1.12.1
helm.sh/helm/v3 v3.20.2
helm.sh/helm/v3 v3.21.3
helm.sh/helm/v4 v4.2.3

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] logic-error

The PR adds helm.sh/helm/v4 v4.2.3 as a new direct dependency alongside helm.sh/helm/v3. However, tools/tools.go only imports helm.sh/helm/v3/cmd/helm. No source file imports helm.sh/helm/v4. The v4 dependency is unused and will be pruned by go mod tidy.

Suggested fix: Either update tools/tools.go to import helm.sh/helm/v4/cmd/helm, or remove helm.sh/helm/v4 from tools/go.mod.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] requested changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code main major renovate size: M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants