chore(deps): update security updates (major)#132
Conversation
|
📝 WalkthroughWalkthroughUpdated Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 180: Remove the redundant indirect entry for the module gopkg.in/yaml.v3
v3.0.1 from go.mod (the duplicate entry added later) so only the primary direct
requirement remains (the one already required earlier in the file); after
removing the duplicate line, run go mod tidy to update go.sum and ensure module
graph consistency.
- Around line 67-68: The go.mod lists github.com/cenkalti/backoff/v5 v5.0.3
twice; remove the duplicate entry so the module appears only once (keep a single
line referencing github.com/cenkalti/backoff/v5 v5.0.3) and then run go mod tidy
to ensure the go.mod and go.sum are normalized; target the duplicate module line
"github.com/cenkalti/backoff/v5 v5.0.3" when making the change.
- Line 30: Remove the invalid duplicate module entry
"gopkg.in/go-jose/go-jose.v4" from go.mod (it conflicts with the canonical
"github.com/go-jose/go-jose/v4" already required); delete the gopkg.in line, run
"go mod tidy" to reconcile dependencies, and ensure no code imports the gopkg.in
path (update any imports to "github.com/go-jose/go-jose/v4" if found).
| golang.org/x/oauth2 v0.34.0 | ||
| golang.org/x/text v0.32.0 | ||
| gopkg.in/go-jose/go-jose.v2 v2.6.3 | ||
| gopkg.in/go-jose/go-jose.v4 v4.1.3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify both module paths are present (should end with only github.com/go-jose/go-jose/v4).
rg -n 'go-jose' go.mod go.sumRepository: formancehq/auth
Length of output: 795
Remove the invalid go-jose v4 module path.
gopkg.in/go-jose/go-jose.v4 is not the canonical import path for v4 and duplicates the correct github.com/go-jose/go-jose/v4 already required at line 13. Remove line 30 entirely.
Proposed fix
- gopkg.in/go-jose/go-jose.v4 v4.1.3📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| gopkg.in/go-jose/go-jose.v4 v4.1.3 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 30, Remove the invalid duplicate module entry
"gopkg.in/go-jose/go-jose.v4" from go.mod (it conflicts with the canonical
"github.com/go-jose/go-jose/v4" already required); delete the gopkg.in line, run
"go mod tidy" to reconcile dependencies, and ensure no code imports the gopkg.in
path (update any imports to "github.com/go-jose/go-jose/v4" if found).
| github.com/cenkalti/backoff/v5 v5.0.3 // indirect | ||
| github.com/cenkalti/backoff/v5 v5.0.3 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify duplicate require lines in go.mod.
rg -n 'github.com/cenkalti/backoff/v5' go.modRepository: formancehq/auth
Length of output: 166
Remove duplicated backoff/v5 requirement.
The same module/version is listed twice; keep one entry to prevent persistent go.mod drift.
Proposed fix
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
- github.com/cenkalti/backoff/v5 v5.0.3 // indirect📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| github.com/cenkalti/backoff/v5 v5.0.3 // indirect | |
| github.com/cenkalti/backoff/v5 v5.0.3 // indirect | |
| github.com/cenkalti/backoff/v5 v5.0.3 // indirect |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` around lines 67 - 68, The go.mod lists github.com/cenkalti/backoff/v5
v5.0.3 twice; remove the duplicate entry so the module appears only once (keep a
single line referencing github.com/cenkalti/backoff/v5 v5.0.3) and then run go
mod tidy to ensure the go.mod and go.sum are normalized; target the duplicate
module line "github.com/cenkalti/backoff/v5 v5.0.3" when making the change.
| google.golang.org/protobuf v1.36.10 // indirect | ||
| gopkg.in/square/go-jose.v2 v2.6.0 // indirect | ||
| gopkg.in/yaml.v2 v2.4.0 // indirect | ||
| gopkg.in/yaml.v3 v3.0.1 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Confirm yaml.v3 appears only once after cleanup.
rg -n 'gopkg.in/yaml.v3' go.modRepository: formancehq/auth
Length of output: 127
Remove duplicate gopkg.in/yaml.v3 indirect entry.
The module is already required directly at line 31. Line 180's indirect entry is redundant and should be removed.
Fix
- gopkg.in/yaml.v3 v3.0.1 // indirect📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| gopkg.in/yaml.v3 v3.0.1 // indirect |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 180, Remove the redundant indirect entry for the module
gopkg.in/yaml.v3 v3.0.1 from go.mod (the duplicate entry added later) so only
the primary direct requirement remains (the one already required earlier in the
file); after removing the duplicate line, run go mod tidy to update go.sum and
ensure module graph consistency.
2 participants
This PR contains the following updates:
v4.3.0->v5.0.3v27.3.1+incompatible->v29.3.0+incompatiblev3.6.1->v4.1.1v1.2.31->v3.0.13v1.0.1->v2.0.0v3.0.7->v4.2.0v1.3.1->v2.1.1v3.5.1->v4.4.0v2.12.2->v3.45.5v2.6.3->v4.1.3v2.4.0->v3.0.1Release Notes
docker/cli (github.com/docker/cli)
v29.3.0+incompatibleCompare Source
v29.2.1+incompatibleCompare Source
v29.2.0+incompatibleCompare Source
v29.1.5+incompatibleCompare Source
v29.1.4+incompatibleCompare Source
v29.1.3+incompatibleCompare Source
v29.1.2+incompatibleCompare Source
v29.1.1+incompatibleCompare Source
v29.1.0+incompatibleCompare Source
v29.0.4+incompatibleCompare Source
v29.0.3+incompatibleCompare Source
v29.0.2+incompatibleCompare Source
v29.0.1+incompatibleCompare Source
v29.0.0+incompatibleCompare Source
v28.5.2+incompatibleCompare Source
v28.5.1+incompatibleCompare Source
v28.5.0+incompatibleCompare Source
v28.4.0+incompatibleCompare Source
v28.3.3+incompatibleCompare Source
v28.3.2+incompatibleCompare Source
v28.3.1+incompatibleCompare Source
v28.3.0+incompatibleCompare Source
v28.2.2+incompatibleCompare Source
v28.2.1+incompatibleCompare Source
v28.2.0+incompatibleCompare Source
v28.1.1+incompatibleCompare Source
v28.1.0+incompatibleCompare Source
v28.0.4+incompatibleCompare Source
v28.0.3+incompatibleCompare Source
v28.0.2+incompatibleCompare Source
v28.0.1+incompatibleCompare Source
v28.0.0+incompatibleCompare Source
v27.5.1+incompatibleCompare Source
v27.5.0+incompatibleCompare Source
v27.4.1+incompatibleCompare Source
v27.4.0+incompatibleCompare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.
Summary by CodeRabbit