chore(deps): update module github.com/ryancurrah/gomodguard to v2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/ryancurrah/gomodguard	v1.4.1 → v2.1.3

---

Release Notes

ryancurrah/gomodguard (github.com/ryancurrah/gomodguard)

v2.1.3

Compare Source

v2.1.1

Compare Source

What's Changed

• chore(deps): bump golang.org/x/mod from 0.34.0 to 0.35.0 by @​dependabot[bot] in #​97
• fix: remove replace directive so go install works for v2 CLI by @​ryancurrah in #​100
• chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 by @​dependabot[bot] in #​98

Full Changelog: ryancurrah/gomodguard@v2.1.0...v2.1.1

v2.1.0

Compare Source

Note: v2.0.0 and v2.0.1 have been retracted. Please use v2.1.0 or later.

Breaking changes

New configuration schema. The .gomodguard.yaml format has been redesigned. Run gomodguard migrate to automatically convert a v1 config to v2.

Before (v1):

allowed:
  modules:
    - github.com/foo/bar
  domains:
    - golang.org

blocked:
  modules:
    - github.com/uudashr/go-module:
        recommendations:
          - golang.org/x/mod
        reason: "use the official library"
  versions:
    - github.com/mitchellh/go-homedir:
        version: "<= 1.1.0"
        reason: "old versions have a bug"

  local_replace_directives: true

After (v2):

allowed:
  - module: github.com/foo/bar
  - module: golang.org
    match-type: prefix

blocked:
  - module: github.com/uudashr/go-module
    recommendations:
      - golang.org/x/mod
    reason: "use the official library"
  - module: github.com/mitchellh/go-homedir
    version: "<= 1.1.0"
    reason: "old versions have a bug"

local_replace_directives: true

Key differences:

• allowed.modules and allowed.domains are replaced by a flat list where each entry has a module field and an optional match-type field (exact, prefix, regex)
• blocked.modules and blocked.versions are merged into a single flat list where each entry has a module field
• match_type is now match-type (hyphen, not underscore)
• local_replace_directives moves from blocked to the top level

New features

Layered match type precedence. Rules can now match by exact (default), prefix, or regex. When multiple rules overlap, exact beats prefix beats regex, with longest prefix winning among prefix rules.

Regex support. Block or allow entire namespaces with regex patterns:

blocked:
  - module: "github.com/badcompany/.*"
    match-type: regex
    reason: "not permitted"

local_replace_directives. Block modules with local filesystem replace directives to catch accidental commits of dev overrides. Multi-module repo aware — sibling modules whose replacement path contains a matching go.mod are automatically permitted.

The gomodguard migrate command converts a v1 .gomodguard.yaml to v2 format and prints to stdout.

-version flag. Prints the installed version.

Split module layout. The library (github.com/ryancurrah/gomodguard/v2) and CLI (github.com/ryancurrah/gomodguard/cmd/gomodguard/v2) are now separate Go modules, allowing the library to be imported without pulling in CLI dependencies.

Changelog

• 082be15 feat: use array with module field for allowed and blocked config

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 1f110f48-e03a-425f-bf11-da284996b01d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 2.x releases. But if you manually upgrade to 2.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.