chore(deps): bump the minor-and-patch group across 1 directory with 15 updates#29
chore(deps): bump the minor-and-patch group across 1 directory with 15 updates#29dependabot[bot] wants to merge 1 commit into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
github-actions
Bot
added
size/M
Dependency Changes DetectedThis PR modifies dependency files. Please review whether these changes are intentional. Changed files:
Maintainer checklist:
|
lml2468
left a comment
lml2468
left a comment
There was a problem hiding this comment.
[REQUEST_CHANGES] — reviewer account matches PR author; do not merge.
CI Failures: Build + Test + Vet all FAILED 🔴
Root cause (from Vet job logs):
go: errors parsing go.mod:
go.mod:3: invalid go version '1.25.0': must match format 1.23
The Dependabot update bumped go.mod's go directive to 1.25.0, but CI runs on GO_VERSION: 1.20 (set in ci.yml). Go 1.20's toolchain cannot parse the 3-component version format (1.25.0); it expects the 1.23-style (major.minor only).
Required Fix
Either:
- Update CI — bump
GO_VERSIONinci.ymlto match the newgo.modrequirement (e.g.1.25) before merging this PR, or - Rebase Dependabot after the CI Go version is updated so the go.mod change becomes compatible.
The 15 dependency bumps themselves look reasonable (minor/patch only, Dependabot-generated), but this PR cannot be merged until CI is green.
Jerry-Xin
left a comment
Jerry-Xin
left a comment
There was a problem hiding this comment.
This dependency bump is in scope, but it currently breaks the repository build and CI.
🔴 Blocking
🔴 Critical — The new dependency set does not compile.
go.mod bumps google.golang.org/grpc to v1.81.1, while go.mod leaves google.golang.org/api at v0.122.0. With this combination, go test ./..., CGO_ENABLED=0 go build -v ./..., and go vet ./... all fail:
# google.golang.org/api/transport/grpc
.../google.golang.org/api@v0.122.0/transport/grpc/dial.go:162:149:
too few values in struct literal of type "google.golang.org/grpc/credentials/google".DefaultCredentialsOptions
go mod why -m google.golang.org/api shows this still comes through the project’s dependency graph via config -> github.com/RichardKnop/machinery/v2/config -> cloud.google.com/go/pubsub -> google.golang.org/api/option. The PR needs to update the Google Cloud/API dependency set consistently, or choose a compatible grpc version.
🔴 Critical — The PR raises the module to Go 1.25 but leaves CI pinned to Go 1.20.
go.mod changes the module directive to go 1.25.0, while CI still sets GO_VERSION: '1.20' in .github/workflows/ci.yml. Simulating that toolchain fails before package loading:
go: errors parsing go.mod:
go.mod:3: invalid go version '1.25.0': must match format 1.23
Several bumped modules now require newer Go versions, including github.com/gin-gonic/gin v1.12.0, google.golang.org/grpc v1.81.1, and multiple golang.org/x/* modules requiring Go 1.25. The CI/toolchain policy must be updated together with this dependency bump, or the selected versions must be reduced to match the existing Go 1.20 support target.
✅ Highlights
The PR is limited to dependency metadata, and the updates include meaningful security-relevant refreshes such as golang.org/x/crypto. However, it is not mergeable until the build and CI compatibility issues above are fixed.
lml2468
left a comment
lml2468
left a comment
There was a problem hiding this comment.
Verdict: CHANGES_REQUESTED — CI red (Build/Test/Vet all fail)
Gate check: CI red → do not deep-review.
Root Cause
The CI failure is NOT the grpc/google-api incompatibility Allen reported. The actual error is more fundamental:
go: errors parsing go.mod:
go.mod:3: invalid go version '1.25.0': must match format 1.23
What happened: one or more of the 15 bumped dependencies requires Go 1.25+. Dependabot auto-updated the go directive from go 1.20 → go 1.25.0. But CI is pinned to GO_VERSION: '1.20' — Go 1.20 can't even parse three-part version numbers (that format was introduced in Go 1.21).
Fix Options
- Bump CI Go version to 1.25+ — but this is a policy decision (Go 1.20 → 1.25 is a major leap)
- Constrain Dependabot — add
ignorerules or version constraints independabot.ymlto avoid deps requiring Go > 1.20 - Split the group — bump deps individually, skip those requiring Go 1.25+
This needs a maintainer decision on Go version policy before the dep bump can proceed.
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/minor-and-patch-cce08499ac
branch
from
da156d6 to
205c38a
Compare
dependabot
Bot
force-pushed
the
dependabot/go_modules/minor-and-patch-cce08499ac
branch
from
205c38a to
10e7013
Compare
…5 updates Bumps the minor-and-patch group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/RichardKnop/machinery/v2](https://github.com/RichardKnop/machinery) | `2.0.10` | `2.0.16` | | [github.com/gin-gonic/gin](https://github.com/gin-gonic/gin) | `1.9.1` | `1.12.0` | | [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.7.1` | `1.10.0` | | [github.com/gocraft/dbr/v2](https://github.com/gocraft/dbr) | `2.7.5` | `2.7.7` | | [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.17` | `1.14.45` | | [github.com/rubenv/sql-migrate](https://github.com/rubenv/sql-migrate) | `1.5.2` | `1.8.1` | | [github.com/spf13/cast](https://github.com/spf13/cast) | `1.5.1` | `1.10.0` | | [github.com/spf13/viper](https://github.com/spf13/viper) | `1.16.0` | `1.21.0` | | [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.15.0` | `1.19.0` | | [github.com/unrolled/secure](https://github.com/unrolled/secure) | `1.13.0` | `1.17.0` | | [go.uber.org/zap](https://github.com/uber-go/zap) | `1.24.0` | `1.28.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.57.0` | `1.81.1` | Updates `github.com/RichardKnop/machinery/v2` from 2.0.10 to 2.0.16 - [Release notes](https://github.com/RichardKnop/machinery/releases) - [Commits](RichardKnop/machinery@v2.0.10...v2.0.16) Updates `github.com/gin-gonic/gin` from 1.9.1 to 1.12.0 - [Release notes](https://github.com/gin-gonic/gin/releases) - [Changelog](https://github.com/gin-gonic/gin/blob/master/CHANGELOG.md) - [Commits](gin-gonic/gin@v1.9.1...v1.12.0) Updates `github.com/go-sql-driver/mysql` from 1.7.1 to 1.10.0 - [Release notes](https://github.com/go-sql-driver/mysql/releases) - [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md) - [Commits](go-sql-driver/mysql@v1.7.1...v1.10.0) Updates `github.com/gocraft/dbr/v2` from 2.7.5 to 2.7.7 - [Release notes](https://github.com/gocraft/dbr/releases) - [Commits](gocraft/dbr@v2.7.5...v2.7.7) Updates `github.com/mattn/go-sqlite3` from 1.14.17 to 1.14.45 - [Release notes](https://github.com/mattn/go-sqlite3/releases) - [Commits](mattn/go-sqlite3@v1.14.17...v1.14.45) Updates `github.com/rubenv/sql-migrate` from 1.5.2 to 1.8.1 - [Commits](rubenv/sql-migrate@v1.5.2...v1.8.1) Updates `github.com/spf13/cast` from 1.5.1 to 1.10.0 - [Release notes](https://github.com/spf13/cast/releases) - [Commits](spf13/cast@v1.5.1...v1.10.0) Updates `github.com/spf13/viper` from 1.16.0 to 1.21.0 - [Release notes](https://github.com/spf13/viper/releases) - [Commits](spf13/viper@v1.16.0...v1.21.0) Updates `github.com/stretchr/testify` from 1.8.3 to 1.11.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.8.3...v1.11.1) Updates `github.com/tidwall/gjson` from 1.15.0 to 1.19.0 - [Commits](tidwall/gjson@v1.15.0...v1.19.0) Updates `github.com/unrolled/secure` from 1.13.0 to 1.17.0 - [Release notes](https://github.com/unrolled/secure/releases) - [Commits](unrolled/secure@v1.13.0...v1.17.0) Updates `go.uber.org/zap` from 1.24.0 to 1.28.0 - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.24.0...v1.28.0) Updates `golang.org/x/crypto` from 0.11.0 to 0.48.0 - [Commits](golang/crypto@v0.11.0...v0.48.0) Updates `google.golang.org/grpc` from 1.57.0 to 1.81.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.57.0...v1.81.1) Updates `google.golang.org/protobuf` from 1.31.0 to 1.36.11 --- updated-dependencies: - dependency-name: github.com/gin-gonic/gin dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/go-sql-driver/mysql dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/gocraft/dbr/v2 dependency-version: 2.7.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/mattn/go-sqlite3 dependency-version: 1.14.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/RichardKnop/machinery/v2 dependency-version: 2.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/rubenv/sql-migrate dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/spf13/cast dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/spf13/viper dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/stretchr/testify dependency-version: 1.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/tidwall/gjson dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/unrolled/secure dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: golang.org/x/crypto dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/grpc dependency-version: 1.81.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/protobuf dependency-version: 1.36.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/go_modules/minor-and-patch-cce08499ac
branch
from
10e7013 to
266f502
Compare
2 participants
Bumps the minor-and-patch group with 12 updates in the / directory:
2.0.102.0.161.9.11.12.01.7.11.10.02.7.52.7.71.14.171.14.451.5.21.8.11.5.11.10.01.16.01.21.01.15.01.19.01.13.01.17.01.24.01.28.01.57.01.81.1Updates
github.com/RichardKnop/machinery/v2from 2.0.10 to 2.0.16Release notes
Sourced from github.com/RichardKnop/machinery/v2's releases.
... (truncated)
Commits
dd7a774fix: try to fix up some dependenciesa51ba78Remove useless import (#846)378ff34Upgrade AWD SDK to v2 (#838)5fd6b17fix: make ci works againdfd7622Add AWS SQS Visibility Heartbeat Feature (#837)327b52dUpdate README.md1f99cf1fix redis backend unit testsff17325doc:add redis sentinel example (#826)f5bd50asupport redis username (#834)ef4a2e7fix ttl field for mongo backend (#829)Updates
github.com/gin-gonic/ginfrom 1.9.1 to 1.12.0Release notes
Sourced from github.com/gin-gonic/gin's releases.
... (truncated)
Changelog
Sourced from github.com/gin-gonic/gin's changelog.
... (truncated)
Commits
73726dcdocs: update documentation to reflect Go version changes (#4552)e292e5cdocs: document and finalize Gin v1.12.0 release (#4551)ae3f524ci: update Go version support to 1.25+ across CI and docs (#4550)38534e2chore(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#4548)472d086fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)fb25834test(context): use http.StatusContinue constant instead of magic number 100 (...6f1d5fetest(render): add comprehensive error handling tests (#4541)5c00df8fix(render): write content length in Data.Render (#4206)db30908chore(logger): allow skipping query string output (#4547)ba093d1chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)Updates
github.com/go-sql-driver/mysqlfrom 1.7.1 to 1.10.0Release notes
Sourced from github.com/go-sql-driver/mysql's releases.
... (truncated)
Changelog
Sourced from github.com/go-sql-driver/mysql's changelog.
... (truncated)
Commits
a065b60release v1.10.0 (#1765)09e4187modernize (#1764)6c44a9aEnhance interpolateParams to correctly handle placeholders (#1732)688ce56Update supported Go version to 1.24–1.26 (#1763)118d07fBump filippo.io/edwards25519 from 1.1.1 to 1.2.0 (#1756)d6b2d3eConsolidate Dependabot update noise by grouping weekly dependency PRs (#1762)037dfd8Fix getSystemVar buffer reuse (#1754)900f330Bump actions/checkout from 4 to 6 (#1758)ab9e380fix staticcheck error (#1761)f298c66Bump actions/setup-go from 5 to 6 (#1757)Updates
github.com/gocraft/dbr/v2from 2.7.5 to 2.7.7Release notes
Sourced from github.com/gocraft/dbr/v2's releases.
Commits
9d56616Add support for mysql optimizer hint comments (#270)2d3da06Add support for CASE, WHEN, ELSE (#266)c638faaUpdate go version and circleci build (#265)3be1adcfix: Postgres DB with non-UTC timezone incorrectly parse in timestamptz field...d1d89a2DOC: fix InsertStmt adds data from struct example (#250)26995efAdd "sqlite" as "sqlite3" dialect alias (#244)85e0c03fix (#259)7d25f69add fossa api key (#258)81abfcaAdd Return*Context() functions (#257)Updates
github.com/mattn/go-sqlite3from 1.14.17 to 1.14.45Commits
7ca6a97Merge pull request #1404 from mattn/sqlite-amalgamation-3053002e2ab931Upgrade SQLite to version 305300275d8c60Merge pull request #1403 from dxbjavid/bind-text64-lengthd1ab49cbind via sqlite3_bind_text64/blob64 to avoid 32-bit length truncationb3b5216Merge pull request #1402 from dxbjavid/guard-resulttext-oversize2af23f7guard oversized string length in ResultText1a7264cMerge pull request #1400 from calmh/unsafereflect9accb92Merge pull request #1399 from calmh/uintsize9d6bf2cMerge pull request #1338 from calmh/dbstatfed9970modernise reflect.SliceHeader to unsafe.SliceUpdates
github.com/rubenv/sql-migratefrom 1.5.2 to 1.8.1Commits
b9b1fe7Bump golang.org/x/crypto from 0.37.0 to 0.45.0e2b42d1use fixed length array (#288)563a2f0updated golanglint ci version35fb337updated golanglint ci version67a517etest fixeddb07bectest fixedc849b7ftest fixed8ad8837test fixedd37ece3fix .golangci.yamlaf578a3run go mod tidyUpdates
github.com/spf13/castfrom 1.5.1 to 1.10.0Release notes
Sourced from github.com/spf13/cast's releases.
... (truncated)
Commits
fc73346Merge pull request #283 from andig/patch-16002cffMerge pull request #298 from spf13/dependabot/github_actions/actions/dependen...c1c153dMerge pull request #300 from spf13/dependabot/github_actions/actions/setup-go...39beeacMerge pull request #301 from spf13/dependabot/github_actions/github/codeql-ac...365e80cbuild(deps): bump github/codeql-action from 3.29.10 to 3.30.19f0f68bbuild(deps): bump actions/setup-go from 5.5.0 to 6.0.0d45deadbuild(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3004f51dMerge pull request #293 from spf13/dependabot/github_actions/actions/checkout...6458e07Merge pull request #295 from spf13/dependabot/github_actions/actions/dependen...970d9eaMerge pull request #296 from spf13/dependabot/github_actions/github/codeql-ac...Updates
github.com/spf13/viperfrom 1.16.0 to 1.21.0Release notes
Sourced from github.com/spf13/viper's releases.