Skip to content

🚨 Update go modules (release-v0.7) (major) #3168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: release-v0.7
Choose a base branch
from
Open

🚨 Update go modules (release-v0.7) (major) #3168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions acceptance/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/conforma/cli/acceptance

go 1.25.9

Check failure on line 3 in acceptance/go.mod

View workflow job for this annotation

GitHub Actions / Test 

Golang version incompatible, saw 1.25.9, running with version: 1.26.0

require (
cuelang.org/go v0.15.1
Expand All @@ -22,7 +22,7 @@
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e
github.com/pkg/errors v0.9.1
github.com/secure-systems-lab/go-securesystemslib v0.10.0
github.com/sigstore/cosign/v2 v2.6.2
github.com/sigstore/cosign/v3 v3.1.0
github.com/sigstore/rekor v1.5.0
github.com/sigstore/sigstore v1.10.5
github.com/stretchr/testify v1.11.1
Expand All @@ -33,7 +33,7 @@
github.com/wiremock/go-wiremock v1.11.0
github.com/yudai/gojsondiff v1.0.0
golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
gopkg.in/go-jose/go-jose.v2 v2.6.3
gopkg.in/go-jose/go-jose.v4 v4.1.4
k8s.io/api v0.35.4
k8s.io/apimachinery v0.35.4

@fullsend-ai-review fullsend-ai-review Bot Jun 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] api-contract

The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with go-jose.v4 v4.1.4 as a direct dependency, but acceptance/image/image.go:60 imports gopkg.in/go-jose/go-jose.v2/json. Since go-jose.v2 and go-jose.v4 are distinct Go modules with different import paths, removing v2 from the require list will break compilation of the acceptance module unless another dependency transitively pulls it in.

Suggested fix: Either update the import in acceptance/image/image.go:60 from gopkg.in/go-jose/go-jose.v2/json to github.com/go-jose/go-jose/v4/json and verify API compatibility, or keep gopkg.in/go-jose/go-jose.v2 as a direct dependency alongside v4.

k8s.io/client-go v0.35.4
Expand Down
Loading
Loading