Revert "build(deps): bump the go_modules group across 1 directory with 2 updates"#47
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR reverts a previous dependency bump by downgrading several Go module indirect dependencies in go.mod (and corresponding entries in go.sum) back to their earlier versions, restoring the dependency state prior to PR #46. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Since this reverts several core networking/crypto libraries (golang.org/x/*, grpc, protobuf), consider adding a brief rationale in the commit or PR description (e.g., specific regression or incompatibility) so future maintainers understand why these versions were intentionally downgraded.
- Double-check that go.sum is fully aligned with the reverted go.mod versions (no leftover entries from the newer dependencies) to avoid subtle build or vendoring inconsistencies.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Since this reverts several core networking/crypto libraries (golang.org/x/*, grpc, protobuf), consider adding a brief rationale in the commit or PR description (e.g., specific regression or incompatibility) so future maintainers understand why these versions were intentionally downgraded.
- Double-check that go.sum is fully aligned with the reverted go.mod versions (no leftover entries from the newer dependencies) to avoid subtle build or vendoring inconsistencies.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
There was a problem hiding this comment.
Code Review
This pull request downgrades several Go dependencies and removes others, such as OpenTelemetry and logr. The reviewer identified that many of the specified versions for golang.org/x packages do not exist in upstream repositories, which will lead to build failures. It is recommended to use go mod tidy to resolve dependencies and update go.sum automatically rather than manually editing these files.
| github.com/yuin/goldmark-emoji v1.0.5 // indirect | ||
| go.opencensus.io v0.24.0 // indirect | ||
| golang.org/x/crypto v0.46.0 // indirect | ||
| golang.org/x/crypto v0.36.0 // indirect |
There was a problem hiding this comment.
The version v0.36.0 for golang.org/x/crypto (and several other versions in this block such as sys v0.34.0, net v0.38.0, sync v0.15.0, term v0.31.0, and text v0.24.0) do not currently exist in the upstream repositories. Reverting to these non-existent versions will cause build failures as the Go toolchain will be unable to resolve them. It is highly recommended to run go mod tidy to allow the Go toolchain to automatically resolve the correct, existing versions for these dependencies.
| cloud.google.com/go/compute/metadata v0.5.0 h1:Zr0eK8JbFv6+Wi4ilXAR8FJ3wyNdpxHKJNPos6LTZOY= | ||
| cloud.google.com/go/compute/metadata v0.5.0/go.mod h1:aHnloV2TPI38yx4s9+wAZhHykWvVCfu7hQbF+9CWoiY= |
There was a problem hiding this comment.
Manually editing go.sum is discouraged as it is error-prone and can lead to checksum mismatch errors. It is recommended to let the Go toolchain manage this file by running go mod tidy after updating go.mod, which will automatically update go.sum with the correct checksums for the resolved dependency tree.
Reverts #46
Summary by Sourcery
Build: