Skip to content

chore(deps): update go dependencies - #2412

Open
red-hat-konflux[bot] wants to merge 1 commit into
release-1.5from
konflux/mintmaker/release-1.5/go-deps
Open

red-hat-konflux[bot] wants to merge 1 commit into
release-1.5from
konflux/mintmaker/release-1.5/go-deps

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending
github.com/cenkalti/backoff/v5 indirect major v5.0.3 → v7.0.1
github.com/distribution/distribution/v3 replace patch v3.1.1 → v3.1.2
github.com/docker/cli indirect minor v29.7.2+incompatible → v29.9.0+incompatible v29.9.1+incompatible
github.com/docker/docker-credential-helpers indirect patch v0.9.9 → v0.9.10
github.com/emicklei/go-restful/v3 indirect minor v3.13.0 → v3.14.0
github.com/fxamacker/cbor/v2 indirect patch v2.9.3 → v2.9.6
github.com/go-openapi/jsonpointer indirect patch v1.0.0 → v1.0.2
github.com/go-openapi/jsonreference indirect patch v1.0.1 → v1.0.3
github.com/go-openapi/swag indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/cmdutils indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/conv indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/fileutils indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/jsonutils indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/loading indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/mangling indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/netutils indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/pools indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/stringutils indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/typeutils indirect patch v0.29.1 → v0.29.2
github.com/go-openapi/swag/yamlutils indirect patch v0.29.1 → v0.29.2
github.com/go-sql-driver/mysql require patch v1.10.0 → v1.10.1
github.com/google/cel-go indirect minor v0.29.2 → v0.30.0
github.com/google/go-containerregistry require patch v0.22.0 → v0.22.1
github.com/google/trillian require minor v1.7.3 → v1.8.0
github.com/grpc-ecosystem/grpc-gateway/v2 indirect minor v2.30.0 → v2.31.0 v2.32.0
github.com/klauspost/compress indirect minor v1.19.2 → v1.20.3
github.com/konflux-ci/coverport/instrumentation/go require digest c914ae0 → e4b4dac
github.com/onsi/ginkgo/v2 require minor v2.32.1 → v2.33.1
github.com/onsi/gomega require minor v1.43.0 → v1.44.0
github.com/openshift/api require digest cfb6385 → e07c1fd
github.com/openshift/controller-runtime-common require digest e1187ec → 8ec0dc8
github.com/prometheus/client_golang indirect minor v1.24.1 → v1.25.0
github.com/prometheus/client_model indirect patch v0.6.2 → v0.6.3
github.com/prometheus/common indirect minor v0.70.1 → v0.72.1
github.com/prometheus/procfs indirect minor v0.21.1 → v0.22.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp indirect minor v0.71.0 → v0.72.0
go.opentelemetry.io/otel indirect minor v1.46.0 → v1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace indirect minor v1.46.0 → v1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc indirect minor v1.46.0 → v1.47.0
go.opentelemetry.io/otel/metric indirect minor v1.46.0 → v1.47.0
go.opentelemetry.io/otel/sdk indirect minor v1.46.0 → v1.47.0
go.opentelemetry.io/otel/trace indirect minor v1.46.0 → v1.47.0
go.opentelemetry.io/proto/otlp indirect patch v1.11.0 → v1.11.1
go.yaml.in/yaml/v2 indirect major v2.4.4 → v3.0.5
golang.org/x/mod indirect minor v0.40.0 → v0.42.0
golang.org/x/net indirect minor v0.58.0 → v0.61.0
golang.org/x/oauth2 indirect minor v0.36.0 → v0.37.0
golang.org/x/sync indirect minor v0.22.0 → v0.24.0
golang.org/x/sys indirect minor v0.47.0 → v0.49.0
golang.org/x/term indirect minor v0.45.0 → v0.47.0
golang.org/x/text indirect minor v0.41.0 → v0.43.0
golang.org/x/time indirect minor v0.15.0 → v0.16.0
golang.org/x/tools require minor v0.49.0 → v0.52.0
golang.org/x/tools indirect minor v0.49.0 → v0.52.0
gomodules.xyz/jsonpatch/v2 indirect major v2.4.0 → v3.0.1
google.golang.org/genproto/googleapis/api indirect digest da73d73 → 4341edf
google.golang.org/genproto/googleapis/rpc indirect digest da73d73 → 4341edf
google.golang.org/grpc indirect minor v1.83.2 → v1.84.0
gopkg.in/evanphx/json-patch.v4 indirect major v4.13.0 → v5.9.11
k8s.io/api require patch v0.37.0 → v0.37.1
k8s.io/apiextensions-apiserver require patch v0.37.0 → v0.37.1
k8s.io/apimachinery require patch v0.37.0 → v0.37.1
k8s.io/apiserver indirect patch v0.37.0 → v0.37.1
k8s.io/client-go require patch v0.37.0 → v0.37.1
k8s.io/component-base indirect patch v0.37.0 → v0.37.1
k8s.io/kube-aggregator require patch v0.37.0 → v0.37.1
k8s.io/streaming indirect patch v0.37.0 → v0.37.1
sigs.k8s.io/apiserver-network-proxy/konnectivity-client indirect minor v0.36.0 → v0.37.0
sigs.k8s.io/controller-runtime require minor v0.24.1 → v0.25.2
sigs.k8s.io/json indirect digest 2d32026 → 11ed52e
sigs.k8s.io/structured-merge-diff/v6 indirect major v6.4.2 → v7.0.0

Warning

Some dependencies could not be looked up. Check the warning logs for more information.


Release Notes

cenkalti/backoff (github.com/cenkalti/backoff/v5)

v7.0.1

Compare Source

v7.0.0

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

distribution/distribution (github.com/distribution/distribution/v3)

v3.1.2

Compare Source

Welcome to the v3.1.2 release of registry!

This is a stable release

This patch release includes security fixes, storage and pagination fixes, and dependency updates.

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes
  • Verify manifest and blob content against the requested digest in the registry client, protecting digest-pinned requests and pull-through caches (CVE-2026-85747 / GHSA-685w-q87j-wqw3).
  • Update security-sensitive dependencies, including gRPC, OpenTelemetry, and golang.org/x/crypto (#​4912, #​4963, #​4965, #​4968). The OTLP gRPC log exporter now honors TLS certificates configured through environment variables.
  • Fix S3 tag pagination and catalog listing when one name is a prefix of another (#​4898, #​4904), and return an empty tag array after the final pagination marker (#​4931).
  • Fix Azure blob type migration and a concurrent append-write race (#​4871, #​4888).
  • Check the storage backend directly when writing blobs to avoid stale descriptor-cache entries (#​4868).
  • Reject malformed manifest digests and out-of-order final upload chunks correctly (#​4945), accept unknown total sizes in Content-Range (#​4892), and preserve upstream error codes (#​4917).
  • Stop the upload purger during registry shutdown (#​4956).
  • Validate S3 redirect endpoints at driver initialization (#​4870).
  • Remove the logrus-logstash-hook dependency while retaining the logstash formatter option (#​4970).
Build Updates
  • Building from source now requires Go 1.26 or newer (#​4961).
  • Container images now use Alpine Linux 3.24 (#​4966).

See the changelog below for the full list of changes.

What's Changed

New Contributors

Full Changelog: distribution/distribution@v3.1.1...v3.1.2

docker/cli (github.com/docker/cli)

v29.9.0+incompatible

Compare Source

v29.8.2+incompatible

Compare Source

v29.8.1+incompatible

Compare Source

v29.8.0+incompatible

Compare Source

docker/docker-credential-helpers (github.com/docker/docker-credential-helpers)

v0.9.10

Compare Source

What's Changed

  • update to go1.26.9
  • build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2
  • build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1
  • build(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0
  • build(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3
  • build(deps): bump the docker-actions group

Full Changelog: docker/docker-credential-helpers@v0.9.9...v0.9.10

emicklei/go-restful (github.com/emicklei/go-restful/v3)

v3.14.0

Compare Source

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.6

Compare Source

v2.9.6 fixes 12 bugs, including an important fix for apps that decode CBOR maps into Go maps, and has one behavior change. API is unchanged but more errors are detected.

Most of these bugs were identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended.

Upgrading to v2.9.6 from all prior versions is recommended.

🐞 Important Fix

For use cases outside the "not affected by this bug" list below, decoding a CBOR null or undefined map key or value (including 55799(null)) into a Go map whose key or value type is of bool, integer, float, or string kind kept the previous map entry's key or value (instead of the zero value). See PR #​855 for details.

Not affected by this bug:

  • Decoding data this codec encoded from the same Go map type, because this codec does not encode to CBOR null from Go values of bool, integer, float, or string kind.
  • Apps that don't decode a CBOR null or undefined map key or value into a Go map whose key or value type is of bool, integer, float, or string kind.
  • Decoding CBOR maps into structs (struct fields of map type follow the bullet above).
  • Decoding CBOR maps into map[any]any, and into any (with unchanged DefaultMapType).
⚠️ Behavior change

Decoding CBOR null or undefined into an interface that holds a value now sets it to nil, matching encoding/json (v1 and v2). Previously, the interface kept its value (PR #​827), which was not the intended behavior.

What's Changed

Some of these bugs could only be triggered by incorrect usage in user apps, such as invalid struct tags or an unsupported DefaultByteStringType setting, etc. None of these bugs were reported by a project affected by them.

Decoding
Encoding
  • Fix encoding self-referencing types by @​fxamacker in #​833
  • Fix panic encoding marshaler of unsupported underlying types by @​fxamacker in #​834
  • Fix omitzero panic encoding struct field of unsupported underlying types implementing marshaler by @​fxamacker in #​835
  • Fix encoding TimeUnixMicro outside 1677 to 2262 by @​fxamacker in #​837
    • Encoded output also changes for some times within one second of either end of that range.
  • Reject encoding time.Time when Go formats wrong year by @​fxamacker in #​838
CI / GitHub Actions and Docs

Full Changelog: fxamacker/cbor@v2.9.4...v2.9.6

v2.9.5

Compare Source

This version was tagged from the default branch by mistake and is retracted.

Use v2.9.6 (https://github.com/fxamacker/cbor/releases/tag/v2.9.6) instead.

v2.9.4

Compare Source

This release fixes potential panics when decoding a CBOR map whose key decodes to an uncomparable Go value under certain conditions.

Not affected: user apps that don't register tag types and don't use map key types that are either named empty interfaces (e.g. type MyAny any) or contain interfaces.

These potential panics can be encountered when one of these two conditions is met:

  • user application registers a tag type (via TagSet interface) that is an array or struct with uncomparable or interface{} element or field type, or
  • user application specifies a destination Go map whose key type is a named empty interface type or a type containing an interface.

This was identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended to cover this bug.

Upgrading to v2.9.4 is recommended.

What's Changed

Full Changelog: fxamacker/cbor@v2.9.3...v2.9.4

go-openapi/jsonpointer (github.com/go-openapi/jsonpointer)

v1.0.2

Compare Source

1.0.2 - 2026-09-24

Full Changelog: go-openapi/jsonpointer@v1.0.1...v1.0.2

7 commits in this release.


Fixed bugs
  • fix: panics in Pointer.Get, Pointer.Set and json name resolution by @​fredbi ...
Documentation
Code quality
Updates
Other (technical)

People who contributed to this release

jsonpointer license terms

License

v1.0.1

Compare Source

1.0.1 - 2026-09-04

Full Changelog: go-openapi/jsonpointer@v1.0.0...v1.0.1

14 commits in this release.


Documentation
Miscellaneous tasks
Updates

People who contributed to this release

jsonpointer license terms

License

go-openapi/jsonreference (github.com/go-openapi/jsonreference)

v1.0.3

Compare Source

1.0.3 - 2026-09-25

Full Changelog: go-openapi/jsonreference@v1.0.2...v1.0.3

4 commits in this release.


Fixed bugs
Security
  • chore(security): upgraded go-openapi/jsonpointer by @​fredbi ...
Updates

People who contributed to this release

jsonreference license terms

License

v1.0.2

Compare Source

1.0.2 - 2026-09-04

Full Changelog: go-openapi/jsonreference@v1.0.1...v1.0.2

4 commits in this release.


Refactor
Documentation
Updates

People who contributed to this release

jsonreference license terms

License

go-openapi/swag (github.com/go-openapi/swag)

v0.29.2

Compare Source

0.29.2 - 2026-09-04

Full Changelog: go-openapi/swag@v0.29.1...v0.29.2

8 commits in this release.


Documentation
Miscellaneous tasks
Updates

People who contributed to this release

swag license terms

License

Per-module changes


cmdutils (0.29.2)

Miscellaneous tasks

conv (0.29.2)

Miscellaneous tasks
Updates

fileutils (0.29.2)

Miscellaneous tasks
Updates

jsonname (0.29.2)

Miscellaneous tasks
Updates

jsonutils/adapters/easyjson (0.29.2)

Miscellaneous tasks
Updates

jsonutils/adapters/testintegration/benchmarks (0.29.2)

Miscellaneous tasks
Updates

jsonutils/adapters/testintegration (0.29.2)

Miscellaneous tasks
Updates

jsonutils/fixtures_test (0.29.2)

Miscellaneous tasks
Updates

jsonutils (0.29.2)

Miscellaneous tasks
  • ch

✂ Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.


Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux

red-hat-konflux Bot commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package Change
go 1.26.3 -> 1.27
github.com/openshift/library-go v0.0.0-20260827165743-93f90ac5198f -> v0.0.0-20261001144932-192662696fc7
golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa -> v0.0.0-20260908205506-85c1c2202aba
File name: pkg/analyzer/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package Change
go 1.25.7 -> 1.26.0

@codecov-commenter

codecov-commenter commented Oct 9, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.86%. Comparing base (eaf722f) to head (a48e725).

Additional details and impacted files
@@               Coverage Diff               @@
##           release-1.5    #2412      +/-   ##
===============================================
+ Coverage        59.73%   66.86%   +7.12%     
===============================================
  Files              302      302              
  Lines            17511    15206    -2305     
===============================================
- Hits             10461    10167     -294     
+ Misses            6316     5034    -1282     
+ Partials           734        5     -729     
Flag Coverage Δ
unit 46.21% <ø> (+5.41%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.5/go-deps branch 6 times, most recently from c8b026e to e4af57c Compare October 15, 2026 02:25
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.5/go-deps branch from e4af57c to a48e725 Compare October 16, 2026 02:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant