Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions go.mod

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai assess risk and feasibility

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== Go module files =='
fd -a '^(go\.mod|go\.sum)$' . -x sh -c 'echo "--- $1"; sed -n "1,240p" "$1"' sh {}

echo
echo '== Testify and YAML imports in Go source =='
rg -n -C 2 --glob '*.go' \
  '"github\.com/stretchr/testify/|"gopkg\.in/yaml\.v3"|"go\.yaml\.in/yaml/v3"' \
  . || true

echo
echo '== Dependency declarations and sums for affected modules =='
rg -n \
  'github\.com/stretchr/testify|github\.com/davecgh/go-spew|github\.com/pmezard/go-difflib|gopkg\.in/yaml\.v3|go\.yaml\.in/yaml/v3' \
  go.mod go.sum 2>/dev/null || true

echo
echo '== Testify module metadata and dependency manifest =='
modcache="$(go env GOMODCACHE 2>/dev/null || true)"
if [ -n "$modcache" ]; then
  testify_mod="$(find "$modcache" -path '*/github.com/stretchr/testify@v1.12.1/go.mod' -print -quit 2>/dev/null || true)"
  if [ -n "$testify_mod" ]; then
    echo "--- $testify_mod"
    cat "$testify_mod"
  else
    echo 'testify v1.12.1 is not present in the local module cache.'
  fi
fi

echo
echo '== GitHub security advisories for testify v1.12.1 =='
gh api '/repos/stretchr/testify/security-advisories?state=published&per_page=100' \
  --jq '.[] | {ghsa_id, severity, published_at, vulnerable_version_range, patched_versions}' \
  2>/dev/null || echo 'GitHub advisory query was unavailable.'

Length of output: 39110


@vyruss, feasibility is high and functional risk is low for the root module.

  • github.com/stretchr/testify is used only by root-module test files.
  • The update does not change application imports or production code paths.
  • gopkg.in/yaml.v3 v3.0.1 remains the YAML module used by production code.
  • go.yaml.in/yaml/v3 v3.0.5 is a separate module path. No repository source imports it directly. Its addition affects the resolved test dependency graph only.
  • Removing github.com/davecgh/go-spew and github.com/pmezard/go-difflib from go.mod is consistent with the new resolved graph. Their historical go.sum entries are harmless.
  • The advisory query returned no published GitHub security advisories for Testify.

One scope note: cmd/compactor has its own go.mod and remains on github.com/stretchr/testify v1.11.1 indirectly. This root-module change does not update that module.

Residual risk: Testify can change assertion formatting or edge-case assertion behavior. CI should run the root module test suite before merge. The sandbox did not execute tests.

You are interacting with an AI system.

Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,15 @@ go 1.26.5

require (
github.com/jackc/pgx/v5 v5.10.0
github.com/stretchr/testify v1.11.1
github.com/stretchr/testify v1.12.1
gopkg.in/yaml.v3 v3.0.1
)

require (
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
go.yaml.in/yaml/v3 v3.0.5 // indirect
golang.org/x/text v0.40.0 // indirect
)
9 changes: 4 additions & 5 deletions go.sum

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai assess risk and feasibility

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- PR metadata and changed files ---'
gh pr view 83 --repo pgEdge/coldfront --json title,body,files,commits \
  --jq '{title, body, commits: [.commits[].messageHeadline], files: [.files[] | {path, additions, deletions}]}'

echo
echo '--- go.mod ---'
cat go.mod

echo
echo '--- Relevant Go imports and dependency references ---'
rg -n -C 2 \
  '"(github\.com/stretchr/testify|go\.yaml\.in/yaml/v3|gopkg\.in/yaml\.v3|github\.com/davecgh/go-spew|github\.com/pmezard/go-difflib)' \
  -g '*.go' .

echo
echo '--- Module graph explanation ---'
go mod why -m github.com/stretchr/testify
go mod why -m go.yaml.in/yaml/v3
go mod why -m github.com/davecgh/go-spew
go mod why -m github.com/pmezard/go-difflib

Length of output: 21150


@vyruss, this update is feasible. I assess the production risk as low.

  • Pull request #83 changes only go.mod and go.sum.
  • github.com/stretchr/testify is used only by test files through assert and require.
  • The application continues to use gopkg.in/yaml.v3 v3.0.1 for configuration parsing.
  • go.yaml.in/yaml/v3 v3.0.5 is an indirect dependency introduced by testify. It does not replace the application YAML dependency.
  • The removed github.com/davecgh/go-spew and github.com/pmezard/go-difflib checksums are expected. go mod why confirms that the resolved module graph no longer needs these modules.

The remaining risk is limited to test compatibility. The v1.12.x release includes assertion and diagnostic behavior changes. The repository does not import testify/mock, which reduces the main API-compatibility risk.

Recommendation: merge after the normal Go test suite passes. No source changes are required based on the current dependency graph.

You are interacting with an AI system.

Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
Expand All @@ -14,15 +12,16 @@ github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
Expand Down