Update go module minor/patch updates #193
+266
−291
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,56 +1,56 @@ | ||
| module github.com/openshift-hyperfleet/hyperfleet-adapter | ||
|
|
||
| go 1.26.0 | ||
|
|
||
| require ( | ||
| github.com/Masterminds/semver/v3 v3.5.0 | ||
| github.com/cloudevents/sdk-go/v2 v2.16.2 | ||
| github.com/go-playground/validator/v10 v10.30.3 | ||
| github.com/go-viper/mapstructure/v2 v2.5.0 | ||
| github.com/google/cel-go v0.28.1 | ||
| github.com/mitchellh/copystructure v1.2.0 | ||
| github.com/openshift-hyperfleet/hyperfleet-broker v1.1.1 | ||
| github.com/openshift-online/maestro v0.0.0-20260202062555-48b47506a254 | ||
| github.com/openshift-online/ocm-sdk-go v0.1.503 | ||
| github.com/prometheus/client_golang v1.23.2 | ||
| github.com/prometheus/client_model v0.6.2 | ||
| github.com/spf13/cobra v1.10.2 | ||
| github.com/spf13/pflag v1.0.10 | ||
| github.com/spf13/viper v1.21.0 | ||
| github.com/stretchr/testify v1.11.1 | ||
| github.com/testcontainers/testcontainers-go v0.42.0 | ||
| go.opentelemetry.io/contrib/propagators/autoprop v0.69.0 | ||
| go.opentelemetry.io/otel v1.44.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 | ||
| go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0 | ||
| go.opentelemetry.io/otel/sdk v1.44.0 | ||
| go.opentelemetry.io/otel/trace v1.44.0 | ||
| golang.org/x/text v0.38.0 | ||
| gopkg.in/yaml.v3 v3.0.1 | ||
| k8s.io/apimachinery v0.36.2 | ||
| k8s.io/client-go v0.36.2 | ||
| open-cluster-management.io/api v1.3.0 | ||
| open-cluster-management.io/sdk-go v1.3.0 | ||
| sigs.k8s.io/controller-runtime v0.24.1 | ||
| sigs.k8s.io/yaml v1.6.0 | ||
| ) | ||
|
|
||
| require ( | ||
| cel.dev/expr v0.25.2 // indirect | ||
| cloud.google.com/go v0.123.0 // indirect | ||
| cloud.google.com/go/auth v0.20.0 // indirect | ||
| cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect | ||
| cloud.google.com/go/compute/metadata v0.9.0 // indirect | ||
| cloud.google.com/go/iam v1.11.0 // indirect | ||
| cloud.google.com/go/pubsub/v2 v2.6.0 // indirect | ||
| dario.cat/mergo v1.0.2 // indirect | ||
| github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect | ||
| github.com/Microsoft/go-winio v0.6.2 // indirect | ||
| github.com/ThreeDotsLabs/watermill v1.5.2 // indirect | ||
| github.com/ThreeDotsLabs/watermill-amqp/v3 v3.1.0 // indirect | ||
| github.com/ThreeDotsLabs/watermill-googlecloud/v2 v2.0.1 // indirect | ||
| github.com/antlr4-go/antlr/v4 v4.13.1 // indirect | ||
| github.com/beorn7/perks v1.0.1 // indirect | ||
| github.com/bwmarrin/snowflake v0.3.0 // indirect | ||
| github.com/cenkalti/backoff/v3 v3.2.2 // indirect | ||
|
|
@@ -64,62 +64,60 @@ require ( | |
| github.com/cpuguy83/dockercfg v0.3.2 // indirect | ||
| github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect | ||
| github.com/distribution/reference v0.6.0 // indirect | ||
| github.com/docker/go-connections v0.7.0 // indirect | ||
| github.com/docker/go-units v0.5.0 // indirect | ||
| github.com/ebitengine/purego v0.10.1 // indirect | ||
| github.com/emicklei/go-restful/v3 v3.13.0 // indirect | ||
| github.com/evanphx/json-patch v5.9.11+incompatible // indirect | ||
| github.com/evanphx/json-patch/v5 v5.9.11 // indirect | ||
| github.com/felixge/httpsnoop v1.1.0 // indirect | ||
| github.com/fsnotify/fsnotify v1.10.1 // indirect | ||
| github.com/fxamacker/cbor/v2 v2.9.2 // indirect | ||
| github.com/gabriel-vasile/mimetype v1.4.13 // indirect | ||
| github.com/getsentry/sentry-go v0.46.2 // indirect | ||
| github.com/go-logr/logr v1.4.3 // indirect | ||
| github.com/go-logr/stdr v1.2.2 // indirect | ||
| github.com/go-ole/go-ole v1.3.0 // indirect | ||
| github.com/go-openapi/jsonpointer v0.23.1 // indirect | ||
| github.com/go-openapi/jsonreference v0.21.6 // indirect | ||
| github.com/go-openapi/swag v0.26.1 // indirect | ||
| github.com/go-openapi/swag/cmdutils v0.26.1 // indirect | ||
| github.com/go-openapi/swag/conv v0.26.1 // indirect | ||
| github.com/go-openapi/swag/fileutils v0.26.1 // indirect | ||
| github.com/go-openapi/swag/jsonname v0.26.1 // indirect | ||
| github.com/go-openapi/swag/jsonutils v0.26.1 // indirect | ||
| github.com/go-openapi/swag/loading v0.26.1 // indirect | ||
| github.com/go-openapi/swag/mangling v0.26.1 // indirect | ||
| github.com/go-openapi/swag/netutils v0.26.1 // indirect | ||
| github.com/go-openapi/swag/stringutils v0.26.1 // indirect | ||
| github.com/go-openapi/swag/typeutils v0.26.1 // indirect | ||
| github.com/go-openapi/swag/yamlutils v0.26.1 // indirect | ||
| github.com/go-playground/locales v0.14.1 // indirect | ||
| github.com/go-playground/universal-translator v0.18.1 // indirect | ||
| github.com/golang/glog v1.2.5 // indirect | ||
| github.com/golang/protobuf v1.5.4 // indirect | ||
| github.com/google/gnostic-models v0.7.1 // indirect | ||
| github.com/google/s2a-go v0.1.9 // indirect | ||
| github.com/google/uuid v1.6.0 // indirect | ||
| github.com/googleapis/enterprise-certificate-proxy v0.3.16 // indirect | ||
| github.com/googleapis/gax-go/v2 v2.22.0 // indirect | ||
| github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect | ||
| github.com/hashicorp/errwrap v1.1.0 // indirect | ||
| github.com/hashicorp/go-multierror v1.1.1 // indirect | ||
| github.com/inconshreveable/mousetrap v1.1.0 // indirect | ||
| github.com/json-iterator/go v1.1.12 // indirect | ||
| github.com/klauspost/compress v1.18.6 // indirect | ||
| github.com/leodido/go-urn v1.4.0 // indirect | ||
| github.com/lithammer/shortuuid/v3 v3.0.7 // indirect | ||
| github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect | ||
| github.com/magiconair/properties v1.8.10 // indirect | ||
| github.com/mitchellh/reflectwalk v1.0.2 // indirect | ||
| github.com/moby/docker-image-spec v1.3.1 // indirect | ||
| github.com/moby/go-archive v0.2.0 // indirect | ||
| github.com/moby/moby/api v1.54.2 // indirect | ||
| github.com/moby/moby/client v0.4.1 // indirect | ||
| github.com/moby/patternmatcher v0.6.1 // indirect | ||
| github.com/moby/sys/sequential v0.7.0 // indirect | ||
| github.com/moby/sys/user v0.4.0 // indirect | ||
| github.com/moby/sys/userns v0.1.0 // indirect | ||
| github.com/moby/term v0.5.2 // indirect | ||
|
|
@@ -129,63 +127,62 @@ require ( | |
| github.com/oklog/ulid v1.3.1 // indirect | ||
| github.com/opencontainers/go-digest v1.0.0 // indirect | ||
| github.com/opencontainers/image-spec v1.1.1 // indirect | ||
| github.com/pelletier/go-toml/v2 v2.3.1 // indirect | ||
| github.com/pkg/errors v0.9.1 // indirect | ||
| github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect | ||
| github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect | ||
| github.com/prometheus/common v0.68.1 // indirect | ||
| github.com/prometheus/procfs v0.20.1 // indirect | ||
| github.com/rabbitmq/amqp091-go v1.11.0 // indirect | ||
| github.com/sagikazarmark/locafero v0.12.0 // indirect | ||
| github.com/segmentio/ksuid v1.0.4 // indirect | ||
| github.com/shirou/gopsutil/v4 v4.26.5 // indirect | ||
| github.com/sirupsen/logrus v1.9.4 // indirect | ||
| github.com/sony/gobreaker v1.0.0 // indirect | ||
| github.com/spf13/afero v1.15.0 // indirect | ||
| github.com/spf13/cast v1.10.0 // indirect | ||
| github.com/subosito/gotenv v1.6.0 // indirect | ||
| github.com/tklauser/go-sysconf v0.4.0 // indirect | ||
| github.com/tklauser/numcpus v0.12.0 // indirect | ||
| github.com/x448/float16 v0.8.4 // indirect | ||
| github.com/yusufpapurcu/wmi v1.2.4 // indirect | ||
| go.opencensus.io v0.24.0 // indirect | ||
| go.opentelemetry.io/auto/sdk v1.2.1 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect | ||
| go.opentelemetry.io/contrib/propagators/aws v1.44.0 // indirect | ||
| go.opentelemetry.io/contrib/propagators/b3 v1.44.0 // indirect | ||
| go.opentelemetry.io/contrib/propagators/jaeger v1.44.0 // indirect | ||
| go.opentelemetry.io/contrib/propagators/ot v1.44.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.44.0 // indirect | ||
| go.opentelemetry.io/proto/otlp v1.10.0 // indirect | ||
| go.uber.org/multierr v1.11.0 // indirect | ||
| go.uber.org/zap v1.28.0 // indirect | ||
| go.yaml.in/yaml/v2 v2.4.4 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/crypto v0.53.0 // indirect | ||
| golang.org/x/exp v0.0.0-20260529124908-c761662dc8c9 // indirect | ||
| golang.org/x/net v0.56.0 // indirect | ||
| golang.org/x/oauth2 v0.36.0 // indirect | ||
| golang.org/x/sync v0.21.0 // indirect | ||
| golang.org/x/sys v0.46.0 // indirect | ||
| golang.org/x/term v0.44.0 // indirect | ||
| golang.org/x/time v0.15.0 // indirect | ||
| google.golang.org/api v0.284.0 // indirect | ||
| google.golang.org/genproto v0.0.0-20260523011958-0a33c5d7ca68 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect | ||
| google.golang.org/grpc v1.81.1 // indirect | ||
| google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect | ||
|
Comment on lines
+176
to
+177
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: The version google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af is a prerelease version [1][2][3]. In the Go module system, versions following the vX.Y.Z-yyyymmddhhmmss-abcdefabcdef format are considered pseudo-versions, which are typically used for development or testing builds and are treated as prereleases compared to tagged, stable releases [3][4]. Regarding google.golang.org/grpc v1.81.1, this is a patch release focused on security and bug fixes [5][6]. It does not introduce breaking changes; instead, it includes the following updates: 1. Security Fix: Resolved a potential authorization bypass in xds/rbac where URI/DNS SANs could incorrectly fall through to the Subject Distinguished Name (DN) when matching authenticated principal names [5][6]. The fix ensures only the first non-empty identity source is used [5][6]. 2. Bug Fix: Fixed an issue in otel (OpenTelemetry) where client and server RPC information were incorrectly mixed, potentially causing one to overwrite the other [5][6]. Breaking changes were not a component of the v1.81.1 release [5][7]. Users should be aware that significant changes, such as increasing the minimum supported Go version to 1.25, were introduced in the preceding v1.81.0 release [8]. Citations:
🏁 Script executed: #!/bin/bash
# Check if broker's go.mod is being modified in this PR, and compare gRPC/protobuf versions
echo "=== Adapter's go.mod (lines 176-177) ==="
sed -n '175,178p' go.mod
echo -e "\n=== Searching for any broker version updates ==="
grep "hyperfleet-broker" go.mod
echo -e "\n=== Checking git diff for go.mod changes (if available) ==="
if git diff HEAD^ HEAD -- go.mod 2>/dev/null | grep -E "(grpc|protobuf|broker)" | head -20; then
echo "Found changes"
else
echo "No git history available"
fiRepository: openshift-hyperfleet/hyperfleet-adapter Length of output: 572 🏁 Script executed: #!/bin/bash
# Check broker's current gRPC and protobuf versions
echo "=== Broker's gRPC and protobuf versions ==="
grep -E "(grpc|protobuf)" go.mod | grep -v "^//" || echo "Not found in broker's go.mod"Repository: openshift-hyperfleet/hyperfleet-broker Length of output: 292 Prerelease protobuf poses supply chain and compatibility risk across adapter↔broker boundary. Lines 176–177 update to gRPC v1.81.1 and protobuf v1.36.12-0.20260120151049-... (prerelease). The pinned Risks:
gRPC v1.81.1 itself introduces no breaking changes (only security fixes including xds/rbac authorization fix and otel bug fix), but prerelease protobuf across the service boundary is unacceptable. Action: Replace prerelease protobuf with stable v1.36.11 or update broker's go.mod to also use v1.36.12 (stable) if available. 🤖 Prompt for AI Agents |
||
| gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/yaml.v2 v2.4.0 // indirect | ||
| k8s.io/api v0.36.2 // indirect | ||
| k8s.io/klog/v2 v2.140.0 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20260520065146-aa012df4f4af // indirect | ||
| k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect | ||
| sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect | ||
| sigs.k8s.io/randfill v1.0.0 // indirect | ||
| sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect | ||
| ) | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 350
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 1548
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 141
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-broker
Length of output: 233
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 564
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 303
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 128
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 564
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 65
🌐 Web query:
Kubernetes v0.36 breaking changes client-go apimachinery API stability💡 Result:
In Kubernetes v1.36, the Go module versions for client-go, apimachinery, and related components were released as v0.36.0 [1][2][3]. While Kubernetes continues to maintain strict API stability guarantees for its external REST APIs, it has also introduced improved formal tracking for Go-level breaking changes in these libraries starting with this release [4]. Key points regarding Go API stability and breaking changes in v0.36: 1. Mandatory Go API Change Tracking: As of v1.36, the Kubernetes project has implemented mandatory tracking of breaking Go API changes for client-go and apimachinery [4]. These changes are now documented in Go-API/CHANGELOG.md files located within their respective repositories, providing developers with a clearer record of incompatible changes and required adaptations [4]. 2. General Stability Policy: Kubernetes maintains a strong backward compatibility policy for its stable REST APIs [5]. However, for Go library consumers (client-go, apimachinery), developers are advised that alpha APIs and internal structures may still evolve or change between releases [3]. The new tracking mechanism specifically addresses the challenge of identifying and managing breaking Go-level changes that previously required manual discovery through source code diffs or non-blocking CI jobs [4]. 3. Release Context: The v1.36 release (codenamed "Haru") included several significant deprecations and removals, such as the removal of the gitRepo volume driver and the deprecation of Service.spec.externalIPs [5]. While these are cluster-level changes, consumers of client-go should review their implementation to ensure compatibility with updated API schemas [5][3]. For specific technical migration requirements, you should consult the Go-API/CHANGELOG.md file within the k8s.io/client-go and k8s.io/apimachinery repositories on GitHub, which now serve as the primary authoritative source for identifying breaking Go API changes introduced in v0.36 [4].
Citations:
🌐 Web query:
gRPC v1.81.0 breaking changes API💡 Result:
gRPC v1.81.0 includes several breaking changes across its various language implementations. Below are the key breaking changes identified for this release: Go (grpc-go) - The minimum supported Go version has been increased to 1.25 [1][2]. Java (grpc-java) - Support for Android API levels 21 and 22 (Lollipop) has been dropped, requiring a minimum of API level 23 (Android 6.0 Marshmallow) [3][4]. - The method LoadBalancer.handleResolvedAddresses has been deprecated [3]. Developers are required to transition to LoadBalancer.acceptResolvedAddresses, which returns a Status object to allow explicit success reporting or rejection of updates [3]. Python (grpcio) - Support for Python 3.9 has been dropped [5][6][7]. - Python 2 backward compatibility syntax, specifically inheritance from (object), has been removed [5][6][7]. Ruby - Support for Ruby 3.1 has been dropped [5][6][7]. In addition to these breaking changes, the v1.81.0 release includes various refinements, bug fixes, and new features across gRPC Core and other language-specific stacks, such as improved metrics emission in Go [1][2] and new observability support for AsyncIO in Python [5][6]. Users are encouraged to review the full release notes for their specific language stack to ensure a smooth upgrade [3][6].
Citations:
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 65
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 152
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-broker
Length of output: 248
OpenTelemetry version mismatch with transitive dependency from hyperfleet-broker creates runtime incompatibility.
Lines 23–28 update OTel core to v1.44.0. However,
hyperfleet-broker v1.1.1(line 12) currently pins v1.41.0 (confirmed in broker's go.mod). When this adapter imports broker, it will pull OTel v1.41.0 transitively while also depending on v1.44.0 directly. This creates a version conflict across the service stack:OTel trace/context propagation APIs changed between v1.41 and v1.44. Conflicting versions can cause trace initialization failures or context loss at runtime (CWE-1104: use of unmaintained/incompatible dependency). Broker's go.mod must be updated to OTel v1.44.0 before merging, or this PR must include a replace directive to align versions.
🤖 Prompt for AI Agents