Update module golang.org/x/net to v0.57.0 - #1184
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
added
approved
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @red-hat-konflux[bot]. Thanks for your PR. I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
WalkthroughUpdated Go module dependency versions in ChangesGo module dependency updates
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 29: Update the Go toolchain version in the publish-release workflow’s
go-version setting from 1.23 to Go 1.25 or newer, ensuring tagged release builds
satisfy the module’s Go 1.25.9 requirement.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 19047833-3c54-4dcd-8fdf-ca97b98c4223
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| go.uber.org/mock v0.6.0 | ||
| golang.org/x/term v0.45.0 | ||
| golang.org/x/text v0.38.0 | ||
| golang.org/x/text v0.40.0 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
grep -nE '^(go|toolchain) ' go.mod || true
fd -H -t f | rg '(^|/)(Makefile|Dockerfile[^/]*|.*\.ya?ml|\.tool-versions)$' \
| xargs -r rg -n 'go-version|golang:|GO_VERSION|toolchain|^go 'Repository: openshift-online/ocm-cli
Length of output: 381
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo '--- go.mod ---'
sed -n '1,60p' go.mod
echo
echo '--- check-pull-request workflow ---'
sed -n '1,120p' .github/workflows/check-pull-request.yaml
echo
echo '--- publish-release workflow ---'
sed -n '1,120p' .github/workflows/publish-release.yamlRepository: openshift-online/ocm-cli
Length of output: 9096
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo '--- GOTOOLCHAIN references ---'
rg -n 'GOTOOLCHAIN|toolchain ' . || true
echo
echo '--- setup-go references ---'
rg -n 'setup-go@|go-version:' .github/workflows || true
echo
echo '--- repo root go/toolchain directives ---'
grep -nE '^(go|toolchain) ' go.mod || trueRepository: openshift-online/ocm-cli
Length of output: 712
🌐 Web query:
Go 1.23 automatic toolchain download go.mod go 1.25.9 behavior actions/setup-go older version
💡 Result:
In modern Go (version 1.21 and later), the go and toolchain directives in go.mod allow the Go toolchain to automatically manage and download required versions, acting similarly to tools like nvm or rustup [1][2]. When a go command is executed, if the currently running Go toolchain version is older than the version specified in the go.mod file, the Go toolchain can automatically download the required version, unpack it, and re-exec the command using that newer version, provided the GOTOOLCHAIN environment variable is set to its default (auto) [1][2]. Regarding the behavior of actions/setup-go (a common GitHub Action for Go) and specific versions like Go 1.25.9: 1. Enforcement via GOTOOLCHAIN=local: To prevent unintended automatic toolchain upgrades in CI/CD environments—which can lead to inconsistent builds—actions/setup-go now defaults to setting GOTOOLCHAIN=local whenever a user explicitly provides a go-version or go-version-file input [3][4][5]. This forces the environment to use the locally installed version and disables the automatic downloading behavior [3][4]. 2. Toolchain Directive Handling: If you use go-version-file: 'go.mod', the action parses your go.mod file [6]. It prioritizes the toolchain directive if present; otherwise, it falls back to the go directive [7][3]. 3. Go 1.25.9 Context: Go 1.25.9 is a legitimate, released minor version (released April 7, 2026) containing security and bug fixes [8][9]. If your go.mod contains toolchain go1.25.9 or go 1.25.9, and you are not using an explicit go-version input that overrides it with GOTOOLCHAIN=local, the Go toolchain would attempt to use or download 1.25.9 [1][2]. However, because actions/setup-go (when configured with a specific version) enforces GOTOOLCHAIN=local, it will prioritize the version you requested in the action configuration over the go.mod directive [3][4][5]. In summary, actions/setup-go is designed to be predictable: by setting GOTOOLCHAIN=local automatically, it prevents the Go toolchain from "auto-switching" to a different version than the one you explicitly defined in your CI workflow [4][5]. If you require the automatic download behavior in CI, you would need to manually override the GOTOOLCHAIN environment variable to auto in your workflow, though this is generally discouraged for stable CI/CD pipelines [4].
Citations:
- 1: https://go.dev/blog/toolchain
- 2: https://go.googlesource.com/proposal/+/refs/heads/master/design/57001-gotoolchain.md
- 3: More specific handling/detection of Go toolchain versions actions/setup-go#457
- 4: Set
GOTOOLCHAIN=localifgo-version[-file]is set andGOTOOLCHAINis not already present actions/setup-go#491 - 5: Improve toolchain handling actions/setup-go#460
- 6: https://github.com/actions/setup-go/blob/main/src/installer.ts
- 7: https://github.com/actions/setup-go/blob/main/README.md
- 8: https://tip.golang.org/doc/devel/release
- 9: https://www.mail-archive.com/golang-nuts@googlegroups.com/msg55915.html
Bump the release workflow to Go 1.25+. .github/workflows/publish-release.yaml still uses go-version: 1.23, which is incompatible with this module’s go 1.25.9 requirement and can break tagged release builds.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 29, Update the Go toolchain version in the publish-release
workflow’s go-version setting from 1.23 to Go 1.25 or newer, ensuring tagged
release builds satisfy the module’s Go 1.25.9 requirement.
This PR contains the following updates:
v0.56.0→v0.57.0Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.
Summary by CodeRabbit