Skip to content

chore(deps): update golang - #20

Open
scality-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/golang
Open

chore(deps): update golang#20
scality-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/golang

Conversation

@scality-renovate

@scality-renovate scality-renovate Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
go (source) golang minor 1.26.5 → 1.27.3
golang (source) stage minor 1.26 → 1.27
golangci/golangci-lint minor v2.14.0 → v2.15.0
kubernetes-sigs/controller-tools minor v0.21.0 → v0.23.0
kubernetes-sigs/kustomize patch v5.8.1 → v5.8.3

Release Notes

golangci/golangci-lint

v2.15.0

Compare Source

Released on 2026-10-16

  1. Linters new features or changes
    • errcheck: from 1.20.0 to 1.30.0
    • exhaustive: from 0.13.0 to 0.15.0 (⚠️ changes)
    • gocognit: from 1.2.1 to 1.3.0
    • golines: from 0.15.0 to 0.16.0
    • govet-modernize: from 0.50.0 to 0.52.0
    • loggercheck: from 0.12.0 to 0.13.0
    • predeclared: from 0.2.2 to 0.3.0
    • wrapcheck: from 2.12.0 to 2.13.0
  2. Linters bug fixes
    • bidichk: from 0.3.3 to 0.3.4
    • canonicalheader: from a25c71c to e18e5c5
    • gofumpt: improve deprecation logs
    • gosec: improve concurrency default value
    • iface: from 1.5.1 to 1.5.3
    • paralleltest: from 1.0.15 to 1.0.16
    • revive: from 1.17.0 to 1.17.1
    • revive: the rules context-keys-type, errorf, modifies-value-receiver, range-val-address, string-of-int, time-equal, time-naming, unexported-return, unhandled-error, var-declaration are working (less randomly).
    • rowserrcheck: from c5f79b8 to e0740d5
    • staticcheck: from 0.8.1 to 0.8.2
  3. Bug fixes
    • fix: compute custom version hash with module versions
    • fix: env vars loading (related to revive)

⚠️ Changes of the exhaustive linter:

  • The replaced options still exists, and partially works, but they are deprecated.
  • The options explicit-exhaustive-switch and explicit-exhaustive-map have been replaced by explicit-exhaustive.
  • The check the value map has been replaced by mapliteral.
  • The option ignore-enum-members (string) has been replaced by ignore-constants (slice).
  • The option ignore-enum-types (string) has been replaced by ignore-types (slice).
  • New report messages.
  • The linter is a now a "slow" linter.
kubernetes-sigs/controller-tools

v0.23.0

Compare Source

This is an additional minor release independent of the Kubernetes release cadence to deliver
#​1474 because this bug fix is a breaking change so it was not possible to backport it.

What's Changed

Dependency bumps

  • 🌱 Bump github.com/onsi/gomega from 1.43.1 to 1.44.0 in the all-go-mod-patch-and-minor group by @​dependabot[bot] in #​1480
  • 🌱 Bump golang.org/x/tools from 0.50.0 to 0.51.0 in the all-go-mod-patch-and-minor group by @​dependabot[bot] in #​1487
  • 🌱 Bump golangci-lint to v2.14.0 and enable promlinter, reassign linters by @​dongjiang1989 in #​1488
  • 🌱 Bump sigs.k8s.io/controller-runtime from v0.24.0 to v0.25.0 by @​dongjiang1989 in #​1476
  • 🌱 Bump softprops/action-gh-release from 3.0.2 to 3.0.3 in the all-github-actions group by @​dependabot[bot] in #​1475
  • 🌱 Bump the all-go-mod-patch-and-minor group across 1 directory with 3 updates by @​dependabot[bot] in #​1478

Full Changelog: kubernetes-sigs/controller-tools@v0.22.0...v0.23.0

v0.22.0

Compare Source

What's Changed

Misc

envtest

Dependency bumps

New Contributors

Full Changelog: kubernetes-sigs/controller-tools@v0.21.0...v0.22.0

kubernetes-sigs/kustomize

v5.8.3

Compare Source

This release eliminates dependencies and compressed blobs that were an issue when bumping kustomize-in-kubectl.
No functional changes in kustomize.

chore

#​6310: chore: bump to Go 1.27 and latest kube-openapi
#​6318: Update kyaml to v0.21.3
#​6320: Update cmd/config to v0.21.3
#​6321: Update api to v0.21.3

v5.8.2

Compare Source

Introduction

In this release, we implemented refactoring to update dependencies and add new features.

This release adds the kustomize edit add configuration and kustomize edit remove component commands. #​6037 #​6083
The built-in OpenAPI schema is now loaded from a pre-compiled bundle embedded in the binary. #​6190
The schema itself is still based on Kubernetes v1.21.2, so the output of kustomize build is not expected to change. If you notice any difference, please file an issue.

Feature

#​6037: feat: add support for 'kustomize edit add configuration' command
#​6083: Add kustomize edit remove component command

fix

#​6263: fix: report an error when the fetched openapi schema is not JSON

Dependencies

#​6075: update go 1.25.7
#​6078: bump go-git and x/crypt
#​6085: update otel lib to v1.40.0
#​6134: drop 'go-spew' dependencies and update dependencies
#​6138: bump k8s.io/kube-openapi, drop github.com/mailru/easyjson
#​6186: bump/go v1.26.5
#​6187: update vuln dependencies at 2026/07
#​6236: chore: bump stretch/testify pkg to remove old yaml dependencies
#​6248: build(deps): bump golang.org/x/text from 0.38.0 to 0.41.0
#​6249: build(deps): bump go.yaml.in/yaml/v2 from 2.4.2 to 2.4.4
#​6251: build(deps): bump github.com/go-errors/errors from 1.4.2 to 1.5.1
#​6254: build(deps): bump github.com/google/gnostic-models from 0.7.0 to 0.7.1
#​6255: build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12
#​6256: build(deps): bump golang.org/x/sys from 0.45.0 to 0.47.0
#​6266: build(deps): bump golang.org/x/text from 0.41.0 to 0.42.0
#​6267: build(deps): bump golang.org/x/sys from 0.47.0 to 0.48.0
#​6273: bump go-git, kin-openapi and k8s.io

chore

#​6190: chore: refactor read scheme to openapi from kubernetes api definition
#​6274: build: use the golangci-lint v2 with release binary
#​6305: Update kyaml to v0.21.2
#​6306: Update cmd/config to v0.21.2
#​6307: Update api to v0.21.2

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@scality-renovate
scality-renovate Bot requested a review from a team as a code owner July 20, 2026 04:19
@scality-renovate scality-renovate Bot added dependencies Pull requests that update a dependency file digest docker go Pull requests that update go code labels Jul 20, 2026
@github-actions

github-actions Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Bump Evaluation

Version change: Go 1.26.5 -> 1.26.6 (patch)
Files changed: go.mod only (1 line - go directive)

Changes (Go 1.26.6, released 2026-08-13):

Security fixes (7):

  • html/template: XSS caused by wrong JavaScript regexp context tracking
  • net/url: quadratic complexity in resolvePath (DoS vector)
  • encoding/xml: (*Decoder).DecodeElement bypasses recursion-depth guard
  • net / x/net/dns/dnsmessage: panic when parsing invalid SVCB record
  • CVE-2026-33818, CVE-2026-56864, CVE-2026-56865
  • crypto/tls: FIPS 140-3 Extended Master Secret enforcement escape hatch

Bug fixes (5): compiler correctness (prove bug, MIPS spill/miscompile), runtime SIGSEGV under high panic load.

Breaking changes: None

Security concerns: None negative -- this bump fixes 7 security issues. Merging promptly is recommended.

Impact on codebase: This project does not directly import the most critical affected packages (html/template, encoding/xml, net/url, net/http). crypto/tls is used in cmd/main.go and the webhook test suite; net appears in the webhook test suite. All standard library fixes are picked up at compile time and also benefit the project transitively through controller-runtime, client-go, and other dependencies.

CI status: Checks are in progress (build, generate, lint, test, test-e2e). Merge once CI is green.

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

@scality-renovate scality-renovate Bot changed the title chore(deps): update golang:1.26 docker digest to ae5a231 chore(deps): update golang:1.26 docker digest to 3aff665 Jul 20, 2026
@scality-renovate scality-renovate Bot changed the title chore(deps): update golang:1.26 docker digest to 3aff665 chore(deps): update golang Jul 31, 2026
@scality-renovate
scality-renovate Bot force-pushed the renovate/golang branch 3 times, most recently from 217ffdf to 63d5f5b Compare August 11, 2026 04:38
@scality-renovate scality-renovate Bot changed the title chore(deps): update golang chore(deps): update go module directive to v1.26.6 Aug 20, 2026
@scality-renovate scality-renovate Bot added minor and removed patch labels Aug 26, 2026
@scality-renovate scality-renovate Bot changed the title chore(deps): update go module directive to v1.26.6 chore(deps): update go module directive to v1.27.0 Aug 26, 2026
@github-actions

github-actions Bot commented Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Bump Evaluation

Updated for the current revision of the PR, which now also bumps the builder image and the tooling.

Version change:

  • go directive 1.26.5 -> 1.27.3; golang builder image 1.26 -> 1.27 (minor)
  • golangci-lint v2.14.0 -> v2.15.0 (minor)
  • controller-tools (controller-gen) v0.21.0 -> v0.23.0 (minor, two releases, pre-1.0)
  • kustomize v5.8.1 -> v5.8.3 (patch)

Changes:

  • Dockerfile builder is now golang:1.27 (re-pinned digest), matching go.mod. This fixes the build break reported in the previous evaluation.
  • controller-tools v0.22: deprecates +kubebuilder:validation:Required/Optional (this repo already uses +required/+optional), plus CRD generator bug fixes. v0.23: adds declarative-validation bounds (#1474, which upstream calls a breaking bug fix), injects min bounds for +k8s:required, and adds an option to omit the version annotation.
  • golangci-lint v2.15: linter updates. The exhaustive option changes do not apply, because that linter is not enabled in .golangci.yml.
  • kustomize v5.8.2/v5.8.3: dependency refresh and new edit subcommands. Upstream says kustomize build output should not change.

Breaking changes: Yes, CI will fail as submitted.

  • generate check: the pre-merge job runs make generate manifests && git diff --quiet. controller-gen v0.23.0 rewrites the controller-gen.kubebuilder.io/version: v0.21.0 annotation in config/crd/bases/warden.scality.com_noderemediationpolicies.yaml (line 6). The PR does not regenerate manifests, so the diff will not be empty and the job will fail. Fix: run make manifests generate and commit the result in this PR. Also check that the schema diff contains nothing besides the version annotation. The API types use only the Minimum, Maximum, MinLength, Enum and XValidation validation markers, +kubebuilder:default and +optional/+required, none of which are known to change, so the annotation is probably the only difference.

Security concerns: None found. The Go 1.27.3 toolchain brings the usual stdlib fixes. All changes are to build tooling from upstream projects. No runtime dependency in go.sum changes.

Impact on codebase:

  • .devcontainer/Dockerfile:1 is still devcontainers/go:1.26-trixie, so the devcontainer will rely on toolchain auto-download. Bump it to 1.27-trixie and re-pin the digest.
  • CONTRIBUTING.md:11 still says Go 1.26+. The project requires docs to be updated in the same PR, so change it to 1.27.3+.
  • make lint builds a custom binary from .custom-gcl.yml, which pins version: v2.12.2. The golangci-lint v2.15.0 bump therefore has no effect on the binary that actually runs. This drift already existed before this PR. Consider adding a renovate annotation to that file.
  • CI was still in progress when this evaluation was written.

Recommendation: BREAKING CHANGES (generate will fail until the CRD is regenerated)

Notes:

  • Fix before merging: commit the make manifests generate output, bump the devcontainer base image, and update CONTRIBUTING.md.
  • The PR is authored by scality-renovate[bot], not dependabot, so it is not eligible for automated approval.

— Claude Code

@scality-renovate scality-renovate Bot changed the title chore(deps): update go module directive to v1.27.0 chore(deps): update go module directive to v1.27.1 Sep 8, 2026
@scality-renovate scality-renovate Bot changed the title chore(deps): update go module directive to v1.27.1 chore(deps): update go module directive to v1.27.2 Oct 15, 2026
@scality-renovate
scality-renovate Bot requested a review from a team as a code owner October 26, 2026 05:55
@scality-renovate scality-renovate Bot changed the title chore(deps): update go module directive to v1.27.2 chore(deps): update go module directive to v1.27.3 Oct 26, 2026
@scality-renovate scality-renovate Bot changed the title chore(deps): update go module directive to v1.27.3 chore(deps): update golang Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TeddyAndrieux TeddyAndrieux Awaiting requested review from TeddyAndrieux TeddyAndrieux is a code owner automatically assigned from scality/platform-dev
@riadelhajjaji-scality riadelhajjaji-scality Awaiting requested review from riadelhajjaji-scality riadelhajjaji-scality is a code owner automatically assigned from scality/platform-dev

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file docker go Pull requests that update go code lint minor patch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ezekiel-alexrod