Skip to content

chore(deps): bump the go-dependencies group with 12 updates #1150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
+167 −167
Closed

chore(deps): bump the go-dependencies group with 12 updates #1150

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 53 additions & 53 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,29 +10,29 @@ require (
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/appservice/armappservice/v2 v2.3.0
github.com/Masterminds/semver/v3 v3.5.0
github.com/andygrunwald/go-jira v1.17.0
github.com/aws/aws-sdk-go-v2 v1.45.1
github.com/aws/aws-sdk-go-v2/config v1.33.1
github.com/aws/aws-sdk-go-v2/credentials v1.20.1
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.4.1
github.com/aws/aws-sdk-go-v2/service/ecs v1.93.0
github.com/aws/aws-sdk-go-v2/service/lambda v1.104.1
github.com/aws/aws-sdk-go-v2/service/s3 v1.109.1
github.com/aws/aws-sdk-go-v2 v1.46.0
github.com/aws/aws-sdk-go-v2/config v1.33.3
github.com/aws/aws-sdk-go-v2/credentials v1.20.3
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.4.3
github.com/aws/aws-sdk-go-v2/service/ecs v1.96.0
github.com/aws/aws-sdk-go-v2/service/lambda v1.107.0
github.com/aws/aws-sdk-go-v2/service/s3 v1.111.0
github.com/aws/smithy-go v1.28.1
github.com/containerd/errdefs v1.0.0
github.com/containers/image/v5 v5.36.2
github.com/go-git/go-billy/v5 v5.9.1
github.com/go-git/go-git/v5 v5.19.2
github.com/go-playground/validator/v10 v10.30.3
github.com/go-playground/validator/v10 v10.30.4
github.com/google/go-github/v42 v42.0.0
github.com/hashicorp/go-retryablehttp v0.7.8
github.com/joshdk/go-junit v1.0.0
github.com/mattn/go-shellwords v1.0.14
github.com/maxcnunes/httpfake v1.2.4
github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5
github.com/mitchellh/go-homedir v1.1.0
github.com/moby/moby/api v1.55.0
github.com/moby/moby/client v0.5.1
github.com/open-policy-agent/opa v1.20.1
github.com/moby/moby/api v1.56.0
github.com/moby/moby/client v0.6.0
Comment on lines +33 to +34

@claude claude Bot Sep 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Highest-risk pair in this bump. moby/moby/client is pre-1.0, so 0.5.1 → 0.6.0 is a minor bump with no compatibility promise, and it carries the API bump to 1.56. Two things to confirm:

  1. Compilation of the three call sites. client.New(client.FromEnv) plus the client.*Options structs are used in internal/docker/docker.go:17, internal/digest/digest.go:254 and cmd/kosli/snapshotDocker.go:103. PR #53509 in the 0.6.0 notes is "minor cleanups, refactors" — that's exactly where option-struct/field renames land in this module. The Main workflow's build is the gate here.
  2. Daemon API version. None of the three call sites pass a negotiation/version option, so whatever the client's default API version is, it applies as-is. With the api module now at 1.56, a user on an older Docker Engine gets client version 1.56 is too new for kosli fingerprint --artifact-type docker and kosli snapshot docker if the client does not negotiate down. Worth one manual check against an older engine (or adding an explicit negotiation option), since CI runners always have a recent daemon and would never see this.

github.com/open-policy-agent/opa v1.20.2

@claude claude Bot Sep 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one is a user-visible bug fix, not just a version number: OPA 1.20.2 fixes the parser regression introduced in 1.20.0 (opa#9140) where stale parse errors were reported for statements starting with { — i.e. a comprehension in a rule body — whenever and/or or import future.keywords were in scope. main currently ships 1.20.1, so kosli evaluate today rejects that class of valid customer policies.

Two follow-ups in the spirit of internal/evaluate/opa_contract_test.go's own header comment:

  • Mention the fix in the release notes for whichever release picks this up — affected users saw a rego_parse_error on a policy that is correct.
  • Pin it with a contract test, so a future regression fails in CI rather than in a customer pipeline:
func TestOPAContract_ComprehensionInBodyParsesWithFutureKeywords(t *testing.T) {
	policy := `package policy

import future.keywords

default allow := false

allow if {
	{y | some y in input.xs} == {1, 2, 3}
}
`
	result, err := Evaluate(policy, map[string]interface{}{"xs": []interface{}{1, 2, 3}}, nil)
	require.NoError(t, err)
	require.True(t, result.Allow)
}

github.com/otiai10/copy v1.14.1
github.com/owenrumney/go-sarif/v2 v2.3.3
github.com/pkg/errors v0.9.1
Expand All @@ -48,7 +48,7 @@ require (
gitlab.com/gitlab-org/api/client-go v1.46.0
golang.org/x/oauth2 v0.36.0
golang.org/x/term v0.45.0
google.golang.org/api v0.295.0
google.golang.org/api v0.297.0
google.golang.org/grpc v1.83.2
google.golang.org/protobuf v1.36.12
gopkg.in/yaml.v3 v3.0.1
Expand Down Expand Up @@ -79,18 +79,18 @@ require (
github.com/agnivade/levenshtein v1.2.1 // indirect
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.19.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.1 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.19.2 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.2 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.2 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.1 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.7.1 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.35.1 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.40.1 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.47.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.2 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.9.0 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.37.0 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.42.0 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.49.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
Expand Down Expand Up @@ -118,32 +118,32 @@ require (
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
github.com/fatih/camelcase v1.0.0 // indirect
github.com/fatih/structs v1.1.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/felixge/httpsnoop v1.1.0 // indirect
github.com/fsnotify/fsnotify v1.10.1 // indirect
github.com/fxamacker/cbor/v2 v2.9.1 // indirect
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
github.com/gabriel-vasile/mimetype v1.4.15 // indirect
github.com/go-errors/errors v1.4.2 // indirect
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
github.com/go-logr/logr v1.4.4 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/jsonpointer v1.0.0 // indirect
github.com/go-openapi/jsonreference v1.0.0 // indirect
github.com/go-openapi/swag v0.27.1 // indirect
github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
github.com/go-openapi/swag/conv v0.27.1 // indirect
github.com/go-openapi/swag/fileutils v0.27.1 // indirect
github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
github.com/go-openapi/swag/loading v0.27.1 // indirect
github.com/go-openapi/swag/mangling v0.27.1 // indirect
github.com/go-openapi/swag/netutils v0.27.1 // indirect
github.com/go-openapi/swag/pools v0.27.1 // indirect
github.com/go-openapi/swag/stringutils v0.27.1 // indirect
github.com/go-openapi/swag/typeutils v0.27.1 // indirect
github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
github.com/go-openapi/swag v0.28.0 // indirect
github.com/go-openapi/swag/cmdutils v0.28.0 // indirect
github.com/go-openapi/swag/conv v0.28.0 // indirect
github.com/go-openapi/swag/fileutils v0.28.0 // indirect
github.com/go-openapi/swag/jsonutils v0.28.0 // indirect
github.com/go-openapi/swag/loading v0.28.0 // indirect
github.com/go-openapi/swag/mangling v0.28.0 // indirect
github.com/go-openapi/swag/netutils v0.28.0 // indirect
github.com/go-openapi/swag/pools v0.28.0 // indirect
github.com/go-openapi/swag/stringutils v0.28.0 // indirect
github.com/go-openapi/swag/typeutils v0.28.0 // indirect
github.com/go-openapi/swag/yamlutils v0.28.0 // indirect
github.com/go-playground/locales v0.14.1 // indirect
github.com/go-playground/universal-translator v0.18.1 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
github.com/gobwas/glob v0.2.3 // indirect
github.com/goccy/go-json v0.10.6 // indirect
github.com/godbus/dbus/v5 v5.2.2 // indirect
Expand All @@ -162,21 +162,21 @@ require (
github.com/googleapis/gax-go/v2 v2.24.0 // indirect
github.com/gorilla/mux v1.8.1 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/kevinburke/ssh_config v1.2.0 // indirect
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
github.com/kylelemons/godebug v1.1.0 // indirect
github.com/leodido/go-urn v1.4.0 // indirect
github.com/leodido/go-urn v1.5.0 // indirect
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
github.com/lestrrat-go/dsig v1.2.1 // indirect
github.com/lestrrat-go/dsig v1.3.0 // indirect
github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
github.com/lestrrat-go/httpcc v1.0.1 // indirect
github.com/lestrrat-go/httprc/v3 v3.0.5 // indirect
github.com/lestrrat-go/jwx/v3 v3.1.1 // indirect
github.com/lestrrat-go/httprc/v3 v3.0.6 // indirect
github.com/lestrrat-go/jwx/v3 v3.2.0 // indirect
github.com/lestrrat-go/option/v2 v2.0.0 // indirect
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
Expand Down Expand Up @@ -213,7 +213,7 @@ require (
github.com/sagikazarmark/locafero v0.11.0 // indirect
github.com/segmentio/asm v1.2.1 // indirect
github.com/sergi/go-diff v1.4.0 // indirect
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/sirupsen/logrus v1.10.2 // indirect
github.com/skeema/knownhosts v1.3.1 // indirect
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
github.com/spf13/afero v1.15.0 // indirect
Expand All @@ -231,14 +231,14 @@ require (
github.com/xlab/treeprint v1.2.0 // indirect
github.com/yashtewari/glob-intersection v0.2.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
go.opentelemetry.io/otel v1.44.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect
go.opentelemetry.io/otel/metric v1.44.0 // indirect
go.opentelemetry.io/otel/sdk v1.44.0 // indirect
go.opentelemetry.io/otel/trace v1.44.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
go.opentelemetry.io/otel v1.46.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 // indirect
go.opentelemetry.io/otel/metric v1.46.0 // indirect
go.opentelemetry.io/otel/sdk v1.46.0 // indirect
go.opentelemetry.io/otel/trace v1.46.0 // indirect
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
go.yaml.in/yaml/v2 v2.4.4 // indirect
go.yaml.in/yaml/v3 v3.0.5 // indirect
Expand All @@ -252,7 +252,7 @@ require (
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.48.0 // indirect
google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
Loading
Loading