Skip to content

Update go dependencies - #226

Open
red-hat-konflux-kflux-prd-rh02[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/go-deps
Open

Update go dependencies#226
red-hat-konflux-kflux-prd-rh02[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/go-deps

Conversation

@red-hat-konflux-kflux-prd-rh02

@red-hat-konflux-kflux-prd-rh02 red-hat-konflux-kflux-prd-rh02 Bot commented Aug 17, 2026 •
edited by bmeng
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df → v4.0.0-20260216212909-7d5770395bb7 age confidence indirect patch
github.com/cenkalti/backoff/v4 v4.1.3 → v4.3.0 age confidence indirect minor
github.com/fxamacker/cbor/v2 v2.9.0 → v2.9.2 age confidence indirect patch v2.9.3
github.com/go-logr/logr v1.4.3 → v1.4.4 age confidence indirect patch
github.com/google/cel-go v0.17.8 → v0.31.0 age confidence indirect minor
github.com/google/gnostic-models v0.7.0 → v0.7.1 age confidence indirect patch
github.com/google/pprof 545e8a4 → ef3492d age confidence indirect digest
github.com/gorilla/css v1.0.0 → v1.0.1 age confidence indirect patch
github.com/matttproud/golang_protobuf_extensions v1.0.1 → v1.0.4 age confidence indirect patch
github.com/microcosm-cc/bluemonday v1.0.18 → v1.0.27 age confidence indirect patch
github.com/onsi/ginkgo/v2 v2.32.0 → v2.32.1 age confidence require patch
github.com/openshift/onsi-ginkgo/v2 8006f30 → d252783 replace digest
github.com/prometheus/client_golang v1.12.1 → v1.24.1 age confidence indirect minor
github.com/prometheus/client_model v0.2.0 → v0.6.2 age confidence indirect minor
github.com/prometheus/common v0.32.1 → v0.70.1 age confidence indirect minor
github.com/prometheus/procfs v0.7.3 → v0.21.1 age confidence indirect minor
github.com/stoewer/go-strcase v1.2.0 → v1.3.1 age confidence indirect minor
go.yaml.in/yaml/v2 v2.4.3 → v2.4.4 age confidence indirect patch
golang.org/x/exp f3d0a9c → c1d0aac age confidence indirect digest
golang.org/x/net v0.56.0 → v0.58.0 age confidence indirect minor
golang.org/x/oauth2 v0.34.0 → v0.36.0 age confidence indirect minor
golang.org/x/term v0.44.0 → v0.45.0 age confidence indirect minor
golang.org/x/text v0.40.0 → v0.41.0 age confidence indirect minor
golang.org/x/time v0.14.0 → v0.15.0 age confidence indirect minor
golang.org/x/tools v0.47.0 → v0.49.0 age confidence indirect minor
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af → v1.36.12 age confidence indirect patch
k8s.io/kube-openapi 43fb72c → d427ff9 age confidence indirect digest
k8s.io/utils b8788ab → cf1189d age confidence require digest
sigs.k8s.io/structured-merge-diff/v6 v6.3.3 → v6.4.2 age confidence indirect minor

Release Notes

cenkalti/backoff (github.com/cenkalti/backoff/v4)

v4.3.0

Compare Source

v4.2.1

Compare Source

v4.2.0

Compare Source

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.2

Compare Source

This release refactors and hardens the streaming encoder by adding stricter checks for encoding CBOR indefinite-length data. Other changes include minor bugfixes, defensive checks, and more tests.

Projects that don't use CBOR indefinite-length data may also want to upgrade (summary of prior releases).

The stricter checks in the encoder prevent improper use of the library and bad inputs from producing malformed CBOR indefinite-length data that would be rejected by the decoder.

This release passed fuzz tests (billions of execs) and it is production quality.

What's Changed

  • Reject encoding indefinite-length map with odd item count by @​fxamacker in #​764
  • Reject encoding indefinite-length data item as a chunk inside indefinite-length byte string or text string by @​fxamacker in #​765
  • Make TagSet.Remove a no-op when contentType is nil by @​fxamacker in #​766
  • Refactor indefinite-length encoding and improve chunk validation during encoding by @​fxamacker in #​767
  • Add more tests, fix a nit in unreachable panic message, update docs & ci by @​fxamacker in #​768
CI / GitHub Actions and Docs
🔎 Details...

Full Changelog: fxamacker/cbor@v2.9.1...v2.9.2

v2.9.1

Compare Source

This release includes important bugfixes, defensive checks, improved code quality, and more tests. Although not public, the fuzzer was also improved by adding more fuzz tests.

🐞 Bug fixes related to the keyasint feature

These changes only affect Go struct fields tagged with keyasint:

  • [Decoding] Reject integer keys that exceed math.MaxInt64 when decoding CBOR map to a struct with keyasint field (PR #​757)
  • [Decoding] Prevent string representation of an integer key from matching the struct field tagged by keyasint (PR #​757)
  • [Encoding & Decoding] Deduplicate struct fields with the same normalized keyasint tag values (PR #​757)
🐞 Other bug fixes and defensive checks

Some of the bugs fixed are related to decoding extreme values that cannot be encoded with this library. For example, the decoder checks if epoch time encoded as CBOR float value representing hundreds of billions of years overflows int64(seconds).

NOTE: It is generally good practice to avoid using floating point to store epoch time (even when not using CBOR).

  • [Decoding] Reject decoding epoch time encoded as floats that overflow int64 (PR #​753)
  • [Encoding] Return a cloned slice for an empty RawMessage from RawMessage.MarshalCBOR (PR #​753)
  • [Encoding] Reject encoding nil inside indefinite-length strings (PR #​750)
  • [Diagnostic] Accept valid U+FFFD replacement character (PR #​753)

What's Changed

CI / GitHub Actions and Docs
🔎 Details...

New Contributors

Full Changelog: fxamacker/cbor@v2.9.0...v2.9.1

go-logr/logr (github.com/go-logr/logr)

v1.4.4

Compare Source

What's Changed
New Contributors

Full Changelog: go-logr/logr@v1.4.3...v1.4.4

google/cel-go (github.com/google/cel-go)

v0.31.0

Compare Source

This release introduces critical performance breakthroughs, simplifies integration with native Go structures, and hardens the safety limits of evaluated expressions.

Features

Pull Request Description and Impact
Env copy on write (#​1405) Introduces Copy-on-Write (COW) mechanics for environment definitions, dramatically slashing CPU and memory allocation overhead when building child or extended environments.
Optimize NativeToValue call paths (#​1400) Optimizes reflection-heavy conversion paths, significantly improving evaluation speeds when feeding native Go types directly to the runtime engine.
Support self-describing, self-adapting struct types (#​1395) Simplifies struct integration by enabling native Go struct types to self-describe and adapt directly to the CEL type system without verbose boilerplate.
Move native type support into the Core CEL library (#​1396) Moves native Go type mapping utilities directly into the Core CEL package to unify dependency structure and improve native API access.
Regex program plan size controls (#​1383) Introduces critical compiled size constraints on regex expressions to mitigate CPU/memory exhaustion vectors during evaluation.
Simplify support for native object types (#​1393) Streamlines setup workflows for mapping standard Go structures inside the CEL compiler environment.
Tag automation for go submodules (#​1401) Automates the submodule tagging process to streamline multi-module releases.

Fixes

Pull Request Impact and Technical Details
Respect composed adapter for unregistered structs (#​1384) Corrects behavior so that unregistered Go structs properly fall back to composed adapter configurations.
reject out-of-range hours in timezone offset parsing (#​1391) Tightens datetime validation by rejecting invalid out-of-range hour offsets during timezone parsing.
Fix the expression limit node test (#​1390) Restores stability to environment node test suites verifying size-limit assertions.
Correct documented default max value for lists.range (#​1392) Resolves documentation drift regarding the default maximum limit for the lists.range function.

Breaking Changes

There are no breaking changes, but all ext.NativeTypes features are now available via cel.NativeTypes

Notes on Performance

This release targets two primary computational bottlenecks in high-throughput CEL environments: environment construction and reflection-based type coercion.

Expected Impact
  1. Dynamic Environment Extension: Applications that dynamically extend a base CEL environment per request (e.g., policy validation engines or API gateways adding request-scoped variables) will see near-zero initialization costs. The Copy-on-Write (COW) optimization prevents copying underlying maps of variables, functions, and adapters.
  2. Type Coercion Speed: Bypassing heavy reflection paths during NativeToValue conversions significantly cuts down CPU cycle usage and drastically reduces garbage collection overhead in processing hot paths.
  3. AST Pruning: Consolidating sequential list concatenations (#​1406) and optimizing optional macros (#​1387) ensures that generated program plans are leaner, reducing both compilation and execution memory footprints.
Go-lang Benchmark Citation (benchstat)

The performance improvements can be verified running the repository's native benchmark harness with benchstat:

name old time/op new time/op delta
BenchmarkEnvExtension/10_vars 3.56µs ± 1% 0.15µs ± 0% -95.79% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 120ns ± 2% 42ns ± 1% -65.00% (p=0.000 n=10+10)
BenchmarkOptionalMapEvaluation 245ns ± 1% 195ns ± 1% -20.41% (p=0.000 n=10+10)

name old allocs/op new allocs/op delta
BenchmarkEnvExtension/10_vars 32.0 ± 0% 1.0 ± 0% -96.88% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10)

New Contributors

Full Changelog: cel-expr/cel-go@v0.30.0...v0.31.0

v0.30.0

Compare Source

What's Changed

New Contributors

Full Changelog: cel-expr/cel-go@v0.29.2...v0.29.3

v0.29.2

Compare Source

What's Changed

Full Changelog: cel-expr/cel-go@v0.29.1...v0.29.2

v0.29.1

Compare Source

What's Changed

Full Changelog: cel-expr/cel-go@v0.29.0...v0.29.1

v0.29.0

Compare Source

What's Changed

New Features
Bug Fixes
Cost Tracking
Testing & Tooling
Documentation

v0.28.1

Compare Source

What's Changed

New Contributors

Full Changelog: cel-expr/cel-go@v0.28.0...v0.28.1

v0.28.0

Compare Source

High-Level Changes

  • Enhanced JSON Interoperability: New support for JSON names across the checker, AST, and runtime allows for more seamless data handling when working with JSON-native structures.
  • Improved Developer Tooling: Integration is now smoother thanks to new utilities for converting Go errors into cel.Issues and more descriptive, context-aware error messages.
  • Greater Environment Flexibility: You can now redeclare variables as constants and export parse limit options, providing finer control over how CEL environments are configured and constrained.
  • Native Struct Improvements: Support for mixing CEL and native values within native structs simplifies the handling of complex, hybrid data types.

🚀 Features

  • Add helper method to check whether a function has a singleton binding in #​1266
  • Helper utility for converting a Go error into cel.Issues in #​1267
  • Policy API improvements in #​1268
  • CEL Test usability requirements in #​1269
  • Better context-related error messages in #​1271
  • Sort env.Config values where reasonable in #​1273
  • Support redeclaring variables as constants in NewEnv in #​1275
  • Add support for exporting parse limit options in #​1277
  • Support mixing CEL values and native values in native structs in #​1270
  • Add checker, AST, and type-provider support for JSON names in #​1283
  • JSON field names runtime support in #​1286
  • Optionally include reachable fieldpaths in prompt in #​1285
  • REPL -- cel-spec pb2 and json name support #​1294

🐞 Bug Fixes

  • Fix support for config-based type references in #​1265
  • Check arg kinds in optional.or and .orValue impl in #​1276
  • Bazel fixes for import in #​1278
  • Support zero-value literals in presence test inlining #​1280
  • Cache concatList.Size() to prevent O(N^2) evaluation time #​1291
  • Preserve runtime error node IDs from Resolve #​1290
  • Default enable identifier escaping with backticks #​1295
  • Cap format string precision to prevent memory exhaustion #​1292

🛠️ Maintenance & Internal

  • chore: Migrate gsutil usage to gcloud storage in #​1274
  • Lint fixes for exported function/type comments in #​1279
  • Lint fixes for import in #​1287

Full Changelog: https://github.com/google/cel-go/compare/v0.27.0...v0.28.0-alpha

v0.27.0

Compare Source

Release Summary

This release focuses on improving developer tooling and stability. Key highlights include significant enhancements to the REPL (YAML configuration support and parse-only evaluation), the addition of cost estimation for regex operations, and improved test coverage reporting.

On the stability front, this release addresses race conditions in reference types, improves namespace resolution, and ensures formatting directives align strictly with the CEL specification.

Note: This release includes a breaking change regarding how types are handled as variables. Please review the "Breaking Changes" section below.

⚠ Breaking Changes

Remove types as variables: The logic for handling types has been relaxed to support safe rollout of feature packages which introduce new types whose names may collide with existing variables. Please review your policies if you relied on types behaving strictly as variables in previous versions. PR #​1262

Features & Enhancements

REPL & Tooling

  • YAML Configuration: The REPL now supports reading and writing YAML environment configurations. PR #​1250

  • Parse-Only Mode: Added parse-only evaluation capabilities to the REPL. PR #​1254

  • Test Coverage: Introduced logic for CEL test coverage calculation and updated the reporter to handle error/unknown scenarios.PR #​1209 & PR #​1215

Core Library

  • Regex Costing: Added support for cost estimation and tracking within the regex library. PR #​1200

  • JSON Type Exposure: Exposed CEL JSON types to assist developers in converting to native values. PR #​1261

  • Policy Composition: Source information is now preserved during CEL policy composition, aiding in debugging. PR #​1253

Extensibility:

  • Updated extension option factory to resolve by ID (#​1249).

  • Refactored match output compiling to accept user-defined logic (#​1246).

  • Exposed Match source ID to callers (#​1227).

Build & Maintenance

  • Bazel: Migrated to use Bazel module only and improved configuration for dependent builds. PR #​1231 & PR #​1228

  • Cleanup: Removed strcase dependency, removed AppEngine code from REPL, and performed general linting. PR #​1230, #​1216, #​1251

Bug Fixes

  • Concurrency: Fixed a race condition in the checker regarding reference types. PR #​1224

  • Namespace Resolution: Addressed an issue with namespace resolution. PR #​1256

  • Spec Compliance: Fixed formatting directives to fully support requirements documented in the cel-spec. PR #​1232

New Contributors

Full Changelog: cel-expr/cel-go@v0.26.1...v0.27.0

v0.26.1

Compare Source

What's Changed

New Contributors

Full Changelog: cel-expr/cel-go@v0.25.1...v0.26.1

v0.26.0

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 6am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux-kflux-prd-rh02

red-hat-konflux-kflux-prd-rh02 Bot commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 -> v1.4.36
github.com/go-openapi/jsonreference v0.21.6 -> v1.0.0

@openshift-ci

openshift-ci Bot commented Aug 17, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux-kflux-prd-rh02[bot]
Once this PR has been reviewed and has the lgtm label, please assign ravitri for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 17, 2026
@openshift-ci

openshift-ci Bot commented Aug 17, 2026

Copy link
Copy Markdown

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@red-hat-konflux-kflux-prd-rh02
red-hat-konflux-kflux-prd-rh02 Bot force-pushed the konflux/mintmaker/main/go-deps branch from 6fb2bdd to 7f2f6fc Compare August 17, 2026 04:05
@bmeng

bmeng commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

/ok-to-test

@openshift-ci openshift-ci Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 18, 2026
@bmeng

bmeng commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

/rebase

@red-hat-konflux-kflux-prd-rh02
red-hat-konflux-kflux-prd-rh02 Bot force-pushed the konflux/mintmaker/main/go-deps branch from 7f2f6fc to 4305f9b Compare August 18, 2026 08:06
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 18, 2026
@red-hat-konflux-kflux-prd-rh02

red-hat-konflux-kflux-prd-rh02 Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: errors parsing go.mod:
go.mod:106: replace github.com/openshift/onsi-ginkgo/v2: version "v2.0.0-20220826191548-d252783cc604" invalid: missing github.com/openshift/onsi-ginkgo/go.mod and .../v2/go.mod at revision d252783cc604

@bmeng

bmeng commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

/retest

@red-hat-konflux-kflux-prd-rh02
red-hat-konflux-kflux-prd-rh02 Bot force-pushed the konflux/mintmaker/main/go-deps branch from 4305f9b to 4fafe15 Compare August 19, 2026 00:06
@red-hat-konflux-kflux-prd-rh02
Update go dependencies
ff7ecf6 
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
@red-hat-konflux-kflux-prd-rh02
red-hat-konflux-kflux-prd-rh02 Bot force-pushed the konflux/mintmaker/main/go-deps branch from 4fafe15 to ff7ecf6 Compare August 19, 2026 08:06
@bmeng

bmeng commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

/retest

@openshift-ci

openshift-ci Bot commented Aug 20, 2026

Copy link
Copy Markdown

@red-hat-konflux-kflux-prd-rh02[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/lint ff7ecf6 link true /test lint
ci/prow/unit ff7ecf6 link true /test unit
ci/prow/upgrade-images ff7ecf6 link true /test upgrade-images
ci/prow/images ff7ecf6 link true /test images
ci/prow/e2e-rosa-hcp-smoke ff7ecf6 link false /test e2e-rosa-hcp-smoke
ci/prow/periodics-images ff7ecf6 link true /test periodics-images
ci/prow/e2e-rosa-classic-smoke ff7ecf6 link false /test e2e-rosa-classic-smoke

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jfrazierRedHat jfrazierRedHat Awaiting requested review from jfrazierRedHat
@tiwillia tiwillia Awaiting requested review from tiwillia

Assignees

No one assigned

Labels

ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bmeng