-
Notifications
You must be signed in to change notification settings - Fork 60
🚨 Update go modules (main) (major) #3133
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -35,7 +35,7 @@ require ( | |
| github.com/yudai/gojsondiff v1.0.0 | ||
| golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f | ||
| golang.org/x/sync v0.22.0 | ||
| gopkg.in/go-jose/go-jose.v2 v2.6.3 | ||
| gopkg.in/go-jose/go-jose.v4 v4.1.4 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] incomplete-security-fix The go-jose upgrade from v2 to v4 addresses GHSA-78h2-9frx-2jm8 and GHSA-c6gw-w398-hv78, but acceptance/image/image.go still imports v2. Security fixes in v4 will not apply to code importing the v2 module path. Suggested fix: Update the import in acceptance/image/image.go to the v4 module path, adapt to API changes, and run go mod tidy to remove v2 from the dependency graph. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] incomplete-major-version-bump go-jose v2→v4: The PR replaces gopkg.in/go-jose/go-jose.v2 with .v4 but acceptance/image/image.go:60 still imports gopkg.in/go-jose/go-jose.v2/json. The old v2 is removed as a direct dependency — if not available transitively, the build will fail. go-jose v4 also removed the json sub-package entirely. Suggested fix: Update acceptance/image/image.go to use 'encoding/json' instead of 'gopkg.in/go-jose/go-jose.v2/json', then remove v2 from the dependency tree. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] known-vulnerable-dependency go-jose v2 has known CVEs (CVE-2023-50658, CVE-2024-28180) but remains in the compiled binary because the source code still imports it. The go.mod change does not remediate these vulnerabilities — the vulnerable module stays in the dependency graph. Suggested fix: Migrate source code away from go-jose v2 imports to actually remove the vulnerable dependency from the module graph. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] correctness go-jose v2→v4 in acceptance module: the require directive replaces gopkg.in/go-jose/go-jose.v2 with .v4, but acceptance/image/image.go still imports gopkg.in/go-jose/go-jose.v2/json. Unlike the root module changes, the old v2 is not preserved as a fallback dependency. The acceptance/go.sum is also not updated with v4 checksums. This may cause build failures. Suggested fix: Update the import in acceptance/image/image.go from gopkg.in/go-jose/go-jose.v2/json to the v4 equivalent, update acceptance/go.sum with v4 checksums, verify API compatibility, and run go mod tidy in the acceptance module. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [critical] build-failure The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4 in acceptance/go.mod, but acceptance/image/image.go (line 60) still imports gopkg.in/go-jose/go-jose.v2/json. Since .v2 is completely removed from the acceptance module's go.mod (no indirect entry remains), the acceptance module will fail to build with an unresolved import error. This also leaves the security vulnerabilities in go-jose v2 (GHSA-78h2-9frx-2jm8, GHSA-c6gw-w398-hv78) unaddressed. Suggested fix: Either (1) keep gopkg.in/go-jose/go-jose.v2 v2.6.3 in acceptance/go.mod until source code is migrated, or (2) update the import in acceptance/image/image.go from gopkg.in/go-jose/go-jose.v2/json to the v4 equivalent and verify API compatibility, then run go mod tidy. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] logic error The acceptance module replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with go-jose.v4 v4.1.4 as a direct dependency, but acceptance/image/image.go:60 still imports 'gopkg.in/go-jose/go-jose.v2/json'. Unlike the main module, go-jose.v2 is NOT retained as an indirect dependency. If no transitive dependency pulls in v2, this causes a build failure. Even if v2 is transitively available, the upgrade provides no security benefit since source continues to use v2. If the intent is to remediate CVE GHSA-78h2-9frx-2jm8 and GHSA-c6gw-w398-hv78, the source import must also be updated. Suggested fix: Update acceptance/image/image.go to import from gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility), or retain .v2 in acceptance/go.mod until the source is migrated. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [critical] build failure The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4, but acceptance/image/image.go:60 still imports 'gopkg.in/go-jose/go-jose.v2/json'. In Go modules, .v2 and .v4 are entirely separate module paths. Since .v2 is completely removed from acceptance/go.mod (not demoted to indirect), this will cause a compilation failure. Suggested fix: Either update acceptance/image/image.go to import the v4 module path and adapt to API changes, or retain gopkg.in/go-jose/go-jose.v2 alongside .v4. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] api-contract The PR replaces gopkg.in/go-jose/go-jose.v2 with gopkg.in/go-jose/go-jose.v4 in acceptance/go.mod, but acceptance/image/image.go line 60 still imports gopkg.in/go-jose/go-jose.v2/json. In Go modules, .v2 and .v4 are distinct module paths. Removing v2 from go.mod while source code still imports it will cause a build failure unless v2 is pulled in transitively. No source file has been updated to use v4. Suggested fix: Either update acceptance/image/image.go to import gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility) and keep v4 in go.mod, or keep v2 in go.mod until the source code is migrated. Run go mod tidy to verify. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] api-contract The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4, but acceptance/image/image.go still imports gopkg.in/go-jose/go-jose.v2/json. Since v2 is removed and not retained as indirect, this will cause a build failure. The json subpackage exists in v4, so migration is straightforward. Suggested fix: Update acceptance/image/image.go to import gopkg.in/go-jose/go-jose.v4/json, or use encoding/json from the standard library. |
||
| k8s.io/api v0.36.0 | ||
| k8s.io/apimachinery v0.36.0 | ||
| k8s.io/client-go v0.36.0 | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,7 +5,7 @@ go 1.26.3 | |
| require ( | ||
| cuelang.org/go v0.16.0 | ||
| github.com/CycloneDX/cyclonedx-go v0.10.0 | ||
| github.com/MakeNowJust/heredoc v1.0.0 | ||
| github.com/MakeNowJust/heredoc/v2 v2.0.1 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [medium] logic-error github.com/MakeNowJust/heredoc/v2 v2.0.1 is added as a direct dependency but no source file imports the v2 path. All 19 files import v1. The v2 dependency is unused. Suggested fix: Either update all 19 source files to import heredoc/v2 or remove the v2 entry from go.mod. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] correctness heredoc v1→v2 major version bump: go.mod adds heredoc/v2 as a direct dependency but all 19 source files still import the v1 path (github.com/MakeNowJust/heredoc). The v2 module is completely unused and would be removed by go mod tidy. Import paths in all consuming .go files must be updated to github.com/MakeNowJust/heredoc/v2. Suggested fix: Update all 19 import statements from github.com/MakeNowJust/heredoc to github.com/MakeNowJust/heredoc/v2, verify the v2 whitespace handling change is acceptable, remove the v1 require entry, and run go mod tidy. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] logic error The PR promotes github.com/MakeNowJust/heredoc/v2 v2.0.1 to a direct dependency and demotes heredoc v1.0.0 to indirect, but all 19 Go source files still import the v1 path. The v2 module is declared as direct but entirely unused. Similarly, github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 is declared as direct, but all 3 source files use the v5 import path. Both v1/v5 are retained as indirect so code compiles, but go mod tidy would reverse these changes. The PR does not accomplish its stated upgrade goal for these two libraries. Suggested fix: Either (a) update all Go source files to use the new import paths (heredoc/v2, jsonschema/v6) and adapt to API changes, or (b) revert the go.mod changes since without source code changes the upgrade has no effect. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [medium] dependency/import mismatch github.com/MakeNowJust/heredoc/v2 v2.0.1 is declared as a direct dependency, but all 19 source files still import github.com/MakeNowJust/heredoc (the v1 path). The v2 dependency is unused and go mod tidy would remove it, reverting the intended upgrade. Suggested fix: Update all 19 source files to import heredoc/v2, then run go mod tidy. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [medium] logic-error The PR adds github.com/MakeNowJust/heredoc/v2 as a direct dependency, but all 19 Go source files still import github.com/MakeNowJust/heredoc (the v1 path). The v2 direct dependency is unused by any source code and will be removed by go mod tidy. heredoc v1 remains a direct dependency in the second require block, so the build will not break. Suggested fix: Either update all 19 Go files to import heredoc/v2 (after verifying API compatibility), or remove heredoc/v2 from go.mod. |
||
| github.com/Maldris/go-billy-afero v0.0.0-20200815120323-e9d3de59c99a | ||
| github.com/conforma/crds/api v0.1.7 | ||
| github.com/conforma/go-gather v1.2.0 | ||
|
|
@@ -29,7 +29,7 @@ require ( | |
| github.com/open-policy-agent/opa v1.15.2 | ||
| github.com/package-url/packageurl-go v0.1.3 | ||
| github.com/qri-io/jsonpointer v0.1.1 | ||
| github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 | ||
| github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [medium] logic-error The PR adds github.com/santhosh-tekuri/jsonschema/v6 as a direct dependency, but all 3 Go source files still import jsonschema/v5. The v6 direct dependency is unused and will be removed by go mod tidy. jsonschema/v5 remains a direct dependency in the second require block, so the build will not break. Suggested fix: Either update the 3 Go files to import jsonschema/v6 and adapt to the v6 API, or remove jsonschema/v6 from go.mod. |
||
| github.com/secure-systems-lab/go-securesystemslib v0.11.0 | ||
| github.com/sigstore/cosign/v3 v3.0.4 | ||
| github.com/sigstore/rekor v1.5.3 | ||
|
|
@@ -63,9 +63,11 @@ require ( | |
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.21.8-0.20260702142841-f9eefe19c7b2 | ||
|
|
||
| require ( | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [low] transitive-dependency-exposure The old heredoc v1.0.0 and jsonschema/v5 v5.3.1 are retained in a separate require block without // indirect comments because source code still imports the v1/v5 paths. Neither has known CVEs. |
||
| github.com/MakeNowJust/heredoc v1.0.0 | ||
| github.com/go-openapi/runtime v0.32.4 | ||
| github.com/google/uuid v1.6.0 | ||
| github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 | ||
| github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 | ||
| golang.org/x/text v0.38.0 | ||
| gopkg.in/yaml.v3 v3.0.1 | ||
| k8s.io/api v0.36.0 | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,8 @@ require ( | |
| github.com/tektoncd/cli v0.44.1 | ||
| github.com/wadey/gocovmerge v0.0.0-20160331181800-b5bfa59ec0ad | ||
| gotest.tools/gotestsum v1.12.1 | ||
| helm.sh/helm/v3 v3.20.2 | ||
| helm.sh/helm/v3 v3.21.3 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [medium] unused dependency helm.sh/helm/v4 v4.2.3 is added as a direct dependency, but tools/tools.go only imports helm.sh/helm/v3/cmd/helm. No source file imports helm/v4. The dependency is unused and go mod tidy would remove it. Suggested fix: Either update tools/tools.go to import helm.sh/helm/v4/cmd/helm, or remove helm.sh/helm/v4 from tools/go.mod. |
||
| helm.sh/helm/v4 v4.2.4 | ||
| k8s.io/kubernetes v1.34.2 | ||
| sigs.k8s.io/kustomize/kustomize/v5 v5.8.1 | ||
| ) | ||
|
|
@@ -81,7 +82,7 @@ require ( | |
| github.com/KeisukeYamashita/go-vcl v0.4.0 // indirect | ||
| github.com/MakeNowJust/heredoc v1.0.0 // indirect | ||
| github.com/Masterminds/goutils v1.1.1 // indirect | ||
| github.com/Masterminds/semver/v3 v3.4.0 // indirect | ||
| github.com/Masterminds/semver/v3 v3.5.0 // indirect | ||
| github.com/Masterminds/sprig/v3 v3.3.0 // indirect | ||
| github.com/Masterminds/squirrel v1.5.4 // indirect | ||
| github.com/Masterminds/vcs v1.13.3 // indirect | ||
|
|
@@ -186,7 +187,7 @@ require ( | |
| github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect | ||
| github.com/curioswitch/go-reassign v0.3.0 // indirect | ||
| github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect | ||
| github.com/cyphar/filepath-securejoin v0.6.1 // indirect | ||
| github.com/cyphar/filepath-securejoin v0.7.0 // indirect | ||
| github.com/dave/dst v0.27.3 // indirect | ||
| github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect | ||
| github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect | ||
|
|
@@ -381,7 +382,7 @@ require ( | |
| github.com/lestrrat-go/jwx/v3 v3.0.13 // indirect | ||
| github.com/lestrrat-go/option/v2 v2.0.0 // indirect | ||
| github.com/letsencrypt/boulder v0.20260309.0 // indirect | ||
| github.com/lib/pq v1.11.2 // indirect | ||
| github.com/lib/pq v1.12.3 // indirect | ||
| github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect | ||
| github.com/lithammer/dedent v1.1.0 // indirect | ||
| github.com/logrusorgru/aurora v2.0.3+incompatible // indirect | ||
|
|
@@ -579,44 +580,44 @@ require ( | |
| gocloud.dev v0.45.0 // indirect | ||
| gocloud.dev/docstore/mongodocstore v0.43.0 // indirect | ||
| gocloud.dev/pubsub/kafkapubsub v0.43.0 // indirect | ||
| golang.org/x/crypto v0.53.0 // indirect | ||
| golang.org/x/crypto v0.54.0 // indirect | ||
| golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect | ||
| golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect | ||
| golang.org/x/mod v0.37.0 // indirect | ||
| golang.org/x/net v0.56.0 // indirect | ||
| golang.org/x/oauth2 v0.36.0 // indirect | ||
| golang.org/x/sync v0.22.0 // indirect | ||
| golang.org/x/sys v0.46.0 // indirect | ||
| golang.org/x/term v0.44.0 // indirect | ||
| golang.org/x/text v0.38.0 // indirect | ||
| golang.org/x/sys v0.47.0 // indirect | ||
| golang.org/x/term v0.45.0 // indirect | ||
| golang.org/x/text v0.40.0 // indirect | ||
| golang.org/x/time v0.15.0 // indirect | ||
| golang.org/x/tools v0.46.0 // indirect | ||
| golang.org/x/tools v0.47.0 // indirect | ||
| golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect | ||
| gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect | ||
| google.golang.org/api v0.286.0 // indirect | ||
| google.golang.org/genproto v0.0.0-20260406210006-6f92a3bedf2d // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect | ||
| google.golang.org/grpc v1.82.0 // indirect | ||
| google.golang.org/grpc v1.82.1 // indirect | ||
| google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/ini.v1 v1.67.3 // indirect | ||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||
| honnef.co/go/tools v0.7.0 // indirect | ||
| k8s.io/api v0.36.0 // indirect | ||
| k8s.io/apiextensions-apiserver v0.36.0 // indirect | ||
| k8s.io/apimachinery v0.36.0 // indirect | ||
| k8s.io/apiserver v0.36.0 // indirect | ||
| k8s.io/cli-runtime v0.36.0 // indirect | ||
| k8s.io/client-go v0.36.0 // indirect | ||
| k8s.io/component-base v0.36.0 // indirect | ||
| k8s.io/component-helpers v0.36.0 // indirect | ||
| k8s.io/api v0.36.2 // indirect | ||
| k8s.io/apiextensions-apiserver v0.36.2 // indirect | ||
| k8s.io/apimachinery v0.36.2 // indirect | ||
| k8s.io/apiserver v0.36.2 // indirect | ||
| k8s.io/cli-runtime v0.36.2 // indirect | ||
| k8s.io/client-go v0.36.2 // indirect | ||
| k8s.io/component-base v0.36.2 // indirect | ||
| k8s.io/component-helpers v0.36.2 // indirect | ||
| k8s.io/klog/v2 v2.140.0 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20260319004828-5883c5ee87b9 // indirect | ||
| k8s.io/kubectl v0.36.0 // indirect | ||
| k8s.io/metrics v0.36.0 // indirect | ||
| k8s.io/streaming v0.36.0 // indirect | ||
| k8s.io/kubectl v0.36.2 // indirect | ||
| k8s.io/metrics v0.36.2 // indirect | ||
| k8s.io/streaming v0.36.2 // indirect | ||
| k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect | ||
| knative.dev/eventing v0.49.2 // indirect | ||
| knative.dev/pkg v0.0.0-20260531000007-52dbd5ece63f // indirect | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[critical] api-contract
The PR replaces gopkg.in/go-jose/go-jose.v2 with v4 in acceptance/go.mod, but acceptance/image/image.go (line 60) still imports gopkg.in/go-jose/go-jose.v2/json. In Go, v2 and v4 are distinct module paths. The acceptance module will not compile.
Suggested fix: Update the import in acceptance/image/image.go to the v4 equivalent (github.com/go-jose/go-jose/v4), or keep v2 alongside v4.