Repository navigation
Conversation
Dependabot opened eleven PRs and ten were red. Every failure was the same thing: govulncheck finding fifteen advisories in the Go standard library at go1.26.0, which main already fixed in 9ca0be9 by requiring go 1.26.6. The PRs only needed a rebase, so nothing here is a new bug -- but rebasing ten branches to re-run the same suite ten times is worse than proving the whole set together once. Go modules (verified locally, all gates green): chi v5.3.0 -> v5.3.2 golang.org/x/sync v0.16.0 -> v0.23.0 prometheus/client_golang v1.23.2 -> v1.24.1 prometheus/client_model v0.6.2 -> v0.6.3 plus the transitives go mod tidy pulled in (prometheus/common, procfs, x/sys, protobuf). gofmt, build, vet, golangci-lint (0 issues), govulncheck ("No vulnerabilities found") and go test -race all pass on the set. Action majors -- all five are the same underlying change, GitHub retiring the node20 runtime, so these are overdue rather than optional: actions/setup-go v5 -> v7 golangci/golangci-lint-action v8 -> v9 docker/setup-qemu-action v3 -> v4 docker/setup-buildx-action v3 -> v4 docker/build-push-action v6 -> v7 The only removals in any of them are build-push-action's DOCKER_BUILD_NO_SUMMARY / DOCKER_BUILD_EXPORT_RETENTION_DAYS envs and setup-buildx-action's deprecated inputs. This workflow sets neither -- it passes setup-buildx no inputs at all -- and v9 still takes the same version: input, so the pinned v2.13.2 lint version carries over unchanged. Dockerfile builder golang:1.26-alpine3.24 -> 1.27-alpine3.24. 1.27 clears the go 1.26.6 directive and stops the image lagging behind the stdlib patches the vulnerability gate is enforcing. This lands as a PR rather than straight to main because Build & Push is needs: test, not PR-gated -- a PR builds all three platforms (amd64/arm64/arm-v7) without pushing, and that build is the only way to exercise the docker action majors before they reach main. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X7CbTa8rZguoxDvqexWtTb
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot opened eleven PRs against this repo and ten of them were red. Every failure was the same failure:
govulncheckreporting fifteen Go standard library advisories atgo1.26.0(GO-2026-4600, GO-2026-4599 and friends), traced throughinternal/app/app.go,internal/app/lifecycle.goandinternal/matrix/client.go, exit code 3.mainalready fixed that in 9ca0be9 by requiringgo 1.26.6. So the red was stale branches, not new bugs — but rebasing ten branches to run the same suite ten times is worse than proving the whole set together once.Go modules
github.com/go-chi/chi/v5golang.org/x/syncgithub.com/prometheus/client_golanggithub.com/prometheus/client_modelplus the transitives
go mod tidypulled in:prometheus/common0.66.1→0.70.1,procfs0.16.1→0.21.1,x/sys0.35.0→0.47.0,protobuf1.36.8→1.36.12.Verified locally on the combined set, not one at a time:
gofmt -l .— cleango build ./.../go vet ./...— okgolangci-lint run ./...— 0 issuesgovulncheck ./...— No vulnerabilities foundgo test -race -count=1 ./...— all 9 packages passAction majors
actions/setup-gov5→v7,golangci/golangci-lint-actionv8→v9,docker/setup-qemu-actionv3→v4,docker/setup-buildx-actionv3→v4,docker/build-push-actionv6→v7.All five are the same underlying change — GitHub retiring the node20 runtime (requires runner ≥ v2.327.1;
ubuntu-latestis far past that) — so they're overdue rather than optional. The only removals anywhere in the five arebuild-push-action'sDOCKER_BUILD_NO_SUMMARY/DOCKER_BUILD_EXPORT_RETENTION_DAYSenvs andsetup-buildx-action's deprecated inputs. This workflow sets neither; it passessetup-buildx-actionno inputs at all.golangci-lint-actionv9 still accepts the sameversion:input, so the pinnedv2.13.2carries over unchanged.Dockerfile
Builder
golang:1.26-alpine3.24→1.27-alpine3.24. 1.27 clears thego 1.26.6directive and stops the image lagging behind the stdlib patches the vulnerability gate is already enforcing.Why a PR and not a push to main
Build & Pushisneeds: test, not PR-gated — on a PR it builds all three platforms (amd64 / arm64 / arm-v7) and just skips the push. That build is the only way to exercise the docker action majors before they reachmain.Supersedes #1, #2, #3, #4, #5, #6, #7, #8, #9, #10, #11. (#1 is already CONFLICTING —
mainmoved past it to chi 5.3.0.)🤖 Generated with Claude Code
https://claude.ai/code/session_01X7CbTa8rZguoxDvqexWtTb