Repository navigation
chore(deps): full dependency round — Go 1.27.3, golangci-lint 2.15, Argo CD 3.5.5 - #435
Merged
Merged
Conversation
- github.com/fluxcd/pkg/apis/meta v1.32.0 -> v1.37.0 - github.com/prometheus/client_golang v1.24.1 -> v1.25.0, common v0.72.1 - github.com/redis/go-redis/v9 v9.22.0 -> v9.23.0 - github.com/alicebob/miniredis/v2 v2.39.0 -> v2.40.0 - github.com/onsi/ginkgo/v2 v2.33.0 -> v2.33.1 - golang.org/x/crypto v0.58.0, x/net v0.61.0, x/tools v0.51.0 (both modules) client_golang 1.25 adds an Infos return to the v1 API's Query, so the e2e Prometheus helper takes four values. kustomize api/kyaml stay at v0.21.2: v0.21.3 requires a kube-openapi built against structured-merge-diff v7, the Kubernetes 1.38 line, which k8s.io/apimachinery v0.37.1 does not compile against. It can move with the 1.38 libraries. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…r tooling Images: golang 1.27.3 (project, devcontainer, mutation lab) and the current distroless static:debug digest. The go.mod directive stays at 1.27.1: it is a minimum, and raising it would break every devcontainer not yet rebuilt, since GOTOOLCHAIN is local. Devcontainer tools: golangci-lint v2.15.0, controller-gen v0.23.0, kustomize 5.8.3, helm v4.3.1, cosign v3.1.4 (and the release.yml installer input), oras 1.3.5, trivy 0.76.1, markdownlint-cli2 0.24.0, tilt v0.37.8, gopls v0.24.0, staticcheck v0.8.2, the common-utils feature 2.7.1, and ginkgo and goimports to match go.mod (lint-toolchain-pins). controller-gen v0.23.0 only moves the version annotation on the CRDs. Actions: download-artifact v8.0.2, upload-artifact v7.0.2, setup-buildx v4.4.1, codeql-action v4.39.1, scorecard-action v2.5.0. The docker-build composite action had drifted behind the workflows (setup-buildx v4.2.0, login v4.3.0, build-push v7.3.0) and now uses the same pins. golangci-lint 2.15 ships exhaustive 0.14, which no longer exempts empty map literals from the map-literal check. The accumulator maps keyed by an enum are now built with make(), which is what they are. predeclared 0.3 also catches a loop variable named append. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- cert-manager v1.21.0 -> v1.21.2 (e2e HelmRelease and the quickstart URL) - valkey chart 0.10.0 -> 0.12.0 (additive values only) - kcp-operator 0.7.7 -> 0.7.10, reflector 10.0.21 -> 10.0.65 - prometheus-operator CRDs v0.89.0 -> v0.94.1 - Argo CD chart 10.1.3 -> 10.10.5 (v3.4.5 -> v3.5.5), with the mirrored redis re-pinned to the chart's 8.6.4-alpine by digest The four Argo CD facts the setup README asks to re-verify on a bump hold at v3.5.5: an unset resourceTrackingMethod is still annotation, the tracking-id key and value format are unchanged, and the repo-server still sets it on every non-CRD target. The chart still leaves the tracking method and server-side apply unset (its ServerSideApply annotation is on CRDs only, as in 10.1.3). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 4 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A full dependency round across every pinned surface: Go modules (both), base images, GitHub Actions, devcontainer tooling, and the e2e cluster charts. Supersedes #434, which fails to compile.
What moves
Go modules: fluxcd/pkg/apis/meta v1.37.0, prometheus client_golang v1.25.0 / common v0.72.1, go-redis v9.23.0, miniredis v2.40.0, ginkgo v2.33.1, x/crypto v0.58.0, x/net v0.61.0, x/tools v0.51.0.
hack/sops-buildtakes the same x/crypto and x/net.Images: golang 1.27.3 for the project, the devcontainer and the mutation lab, plus the current distroless
static:debugdigest.Devcontainer tools: golangci-lint v2.15.0, controller-gen v0.23.0, kustomize 5.8.3, helm v4.3.1, cosign v3.1.4, oras 1.3.5, trivy 0.76.1, markdownlint-cli2 0.24.0, tilt v0.37.8, gopls v0.24.0, staticcheck v0.8.2, and the common-utils feature 2.7.1. ginkgo and goimports move to match go.mod.
Actions: download-artifact v8.0.2, upload-artifact v7.0.2, setup-buildx v4.4.1, codeql-action v4.39.1, scorecard-action v2.5.0, and cosign-installer's
cosign-releasev3.1.4.e2e cluster: cert-manager v1.21.2 (also the quickstart URL), valkey chart 0.12.0, kcp-operator 0.7.10, reflector 10.0.65, prometheus-operator CRDs v0.94.1, and the Argo CD chart 10.10.5 (v3.4.5 → v3.5.5).
Things held back or needing a code change
k8s.io/apimachineryv0.37.1 doesn't compile against it. This is why chore(deps): Bump the "all-dependencies" group with 4 updates across multiple ecosystems #434 is red. It can move together with the 1.38 libraries.godirective stays at 1.27.1. It's only a minimum. The 1.27.3 fixes reach users through the images. Raising it would break every devcontainer that hasn't been rebuilt, becauseGOTOOLCHAINislocal.Infosreturn value tov1.API.Query, so the e2e Prometheus helper now takes four values.make(). predeclared 0.3 also flagged a loop variable namedappend, which is renamed.docker-buildcomposite action had drifted behind the workflows (setup-buildx v4.2.0, login v4.3.0, build-push v7.3.0). Dependabot's/entry doesn't reach it. It now uses the same pins as the workflows.Argo CD 3.5.5
The redis image is re-pinned to the chart's
8.6.4-alpinethroughmirror.gcr.io, by digest. The four upstream facts the setup README asks you to re-check on a bump all still hold at v3.5.5:resourceTrackingMethodstill meansannotation.The chart still leaves the tracking method and server-side apply unset. Its
ServerSideApplyannotation applies only to CRDs, the same as in 10.1.3.Validation
task lint(with golangci-lint v2.15.0 and controller-gen v0.23.0) andtask testpass locally. e2e is left to CI.🤖 Generated with Claude Code