Skip to content

[TT-12311] exp/modcheck: Update go.mod dependencies#6337

Merged
titpetric merged 2 commits into
masterfrom
update/TT-12311/update-go-mod-dependencies
Jun 13, 2024
Merged

[TT-12311] exp/modcheck: Update go.mod dependencies#6337
titpetric merged 2 commits into
masterfrom
update/TT-12311/update-go-mod-dependencies

Conversation

@buger

@buger buger commented Jun 10, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

Triggered by: titpetric

IMPORT VERSION LATEST WARNINGS CVES
cenkalti/backoff/v4 v4.2.1 v4.3.0
getkin/kin-openapi v0.115.0 v0.125.0 Held back from upgrade
golang/protobuf v1.5.3 v1.5.4
gorilla/websocket v1.5.1 v1.5.2 0 of 1
hashicorp/consul/api v1.26.1 v1.29.1
hashicorp/go-version v1.6.0 v1.7.0
hashicorp/vault/api v1.12.1 v1.14.0
miekg/dns v1.1.57 v1.1.59 0 of 3
openzipkin/zipkin-go v0.4.2 v0.4.3
oschwald/maxminddb-golang v1.12.0 v1.13.0
robertkrimen/otto v0.3.0 v0.4.0
rs/cors v1.10.1 v1.11.0 0 of 1
stretchr/testify v1.8.4 v1.9.0
valyala/fasthttp v1.51.0 v1.54.0 0 of 1
golang.org/x/crypto v0.21.0 v0.24.0 0 of 9
golang.org/x/net v0.21.0 v0.26.0 0 of 16
golang.org/x/sync v0.6.0 v0.7.0
google.golang.org/grpc v1.62.1 v1.64.0 0 of 1
google.golang.org/protobuf v1.33.0 v1.34.1 0 of 2
go-redsync/redsync/v4 v4.11.0 v4.13.0 Held back from upgrade
redis/go-redis/v9 v9.4.0 v9.5.3
newrelic/go-agent v2.13.0 +incompatible v3.33.0+incompatible Held back from upgrade
go.opentelemetry.io/otel v1.19.0 v1.27.0 Held back from upgrade
go.opentelemetry.io/otel/trace v1.19.0 v1.27.0 Held back from upgrade
Steps performed 
+ go get github.com/cenkalti/backoff/[email protected]
go: downloading github.com/cenkalti/backoff/v4 v4.3.0
go: upgraded github.com/cenkalti/backoff/v4 v4.2.1 => v4.3.0
+ go get github.com/golang/[email protected]
go: downloading github.com/golang/protobuf v1.5.4
go: module github.com/golang/protobuf is deprecated: Use the "google.golang.org/protobuf" module instead.
go: upgraded github.com/golang/protobuf v1.5.3 => v1.5.4
+ go get github.com/gorilla/[email protected]
go: downloading github.com/gorilla/websocket v1.5.2
go: downloading golang.org/x/net v0.23.0
go: upgraded github.com/gorilla/websocket v1.5.1 => v1.5.2
go: upgraded golang.org/x/net v0.21.0 => v0.23.0
+ go get github.com/hashicorp/consul/[email protected]
go: downloading github.com/hashicorp/consul/api v1.29.1
go: downloading golang.org/x/sys v0.19.0
go: downloading github.com/hashicorp/consul/sdk v0.16.1
go: downloading golang.org/x/crypto v0.22.0
go: downloading golang.org/x/net v0.24.0
go: upgraded github.com/hashicorp/consul/api v1.26.1 => v1.29.1
go: upgraded golang.org/x/crypto v0.21.0 => v0.22.0
go: upgraded golang.org/x/net v0.23.0 => v0.24.0
go: upgraded golang.org/x/sys v0.18.0 => v0.19.0
+ go get github.com/hashicorp/[email protected]
go: downloading github.com/hashicorp/go-version v1.7.0
go: upgraded github.com/hashicorp/go-version v1.6.0 => v1.7.0
+ go get github.com/hashicorp/vault/[email protected]
go: downloading github.com/hashicorp/vault v1.14.0
go: downloading github.com/hashicorp/vault/api v1.14.0
go: downloading github.com/go-jose/go-jose/v4 v4.0.1
go: downloading github.com/hashicorp/go-retryablehttp v0.7.6
go: downloading golang.org/x/net v0.25.0
go: downloading golang.org/x/crypto v0.23.0
go: downloading golang.org/x/text v0.15.0
go: downloading github.com/hashicorp/go-hclog v1.6.3
go: downloading golang.org/x/sys v0.20.0
go: added github.com/go-jose/go-jose/v4 v4.0.1
go: upgraded github.com/hashicorp/go-hclog v1.5.0 => v1.6.3
go: upgraded github.com/hashicorp/go-retryablehttp v0.6.6 => v0.7.6
go: upgraded github.com/hashicorp/vault/api v1.12.1 => v1.14.0
go: upgraded golang.org/x/crypto v0.22.0 => v0.23.0
go: upgraded golang.org/x/net v0.24.0 => v0.25.0
go: upgraded golang.org/x/sys v0.19.0 => v0.20.0
go: upgraded golang.org/x/text v0.14.0 => v0.15.0
+ go get github.com/miekg/[email protected]
go: downloading github.com/miekg/dns v1.1.59
go: downloading golang.org/x/tools v0.19.0
go: downloading golang.org/x/mod v0.16.0
go: upgraded github.com/miekg/dns v1.1.57 => v1.1.59
go: upgraded golang.org/x/mod v0.14.0 => v0.16.0
go: upgraded golang.org/x/tools v0.17.0 => v0.19.0
+ go get github.com/openzipkin/[email protected]
go: downloading github.com/openzipkin/zipkin-go v0.4.3
go: downloading github.com/IBM/sarama v1.43.1
go: downloading github.com/eapache/go-resiliency v1.6.0
go: downloading github.com/klauspost/compress v1.17.8
go: downloading github.com/pierrec/lz4/v4 v4.1.21
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/stretchr/testify v1.9.0
go: downloading google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20240415180920-8c6c420018be
go: downloading google.golang.org/grpc v1.63.2
go: upgraded github.com/IBM/sarama v1.42.1 => v1.43.1
go: upgraded github.com/eapache/go-resiliency v1.4.0 => v1.6.0
go: upgraded github.com/klauspost/compress v1.17.0 => v1.17.8
go: upgraded github.com/openzipkin/zipkin-go v0.4.2 => v0.4.3
go: upgraded github.com/pierrec/lz4/v4 v4.1.18 => v4.1.21
go: upgraded github.com/stretchr/objx v0.5.0 => v0.5.2
go: upgraded github.com/stretchr/testify v1.8.4 => v1.9.0
go: upgraded google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80 => v0.0.0-20240227224415-6ceb2ff114de
go: upgraded google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 => v0.0.0-20240415180920-8c6c420018be
go: upgraded google.golang.org/grpc v1.62.1 => v1.63.2
+ go get github.com/oschwald/[email protected]
go: downloading github.com/oschwald/maxminddb-golang v1.13.0
go: upgraded github.com/oschwald/maxminddb-golang v1.12.0 => v1.13.0
+ go get github.com/robertkrimen/[email protected]
go: downloading github.com/robertkrimen/otto v0.4.0
go: upgraded github.com/robertkrimen/otto v0.3.0 => v0.4.0
+ go get github.com/rs/[email protected]
go: downloading github.com/rs/cors v1.11.0
go: upgraded github.com/rs/cors v1.10.1 => v1.11.0
+ go get github.com/stretchr/[email protected]
+ go get github.com/valyala/[email protected]
go: downloading github.com/valyala/fasthttp v1.54.0
go: upgraded github.com/valyala/fasthttp v1.51.0 => v1.54.0
+ go get golang.org/x/[email protected]
go: downloading golang.org/x/crypto v0.24.0
go: downloading golang.org/x/sync v0.7.0
go: downloading golang.org/x/mod v0.17.0
go: downloading golang.org/x/sys v0.21.0
go: downloading golang.org/x/text v0.16.0
go: downloading golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d
go: upgraded golang.org/x/crypto v0.23.0 => v0.24.0
go: upgraded golang.org/x/mod v0.16.0 => v0.17.0
go: upgraded golang.org/x/sync v0.6.0 => v0.7.0
go: upgraded golang.org/x/sys v0.20.0 => v0.21.0
go: upgraded golang.org/x/text v0.15.0 => v0.16.0
go: upgraded golang.org/x/tools v0.19.0 => v0.21.1-0.20240508182429-e35e4ccd0d2d
+ go get golang.org/x/[email protected]
go: downloading golang.org/x/net v0.26.0
go: upgraded golang.org/x/net v0.25.0 => v0.26.0
+ go get golang.org/x/[email protected]
+ go get google.golang.org/[email protected]
go: downloading google.golang.org/grpc v1.64.0
go: downloading google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237
go: upgraded google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de => v0.0.0-20240318140521-94a12d6c2237
go: upgraded google.golang.org/grpc v1.63.2 => v1.64.0
+ go get google.golang.org/[email protected]
go: downloading google.golang.org/protobuf v1.34.1
go: upgraded google.golang.org/protobuf v1.33.0 => v1.34.1
+ go get github.com/redis/go-redis/[email protected]
go: downloading github.com/redis/go-redis/v9 v9.5.3
go: upgraded github.com/redis/go-redis/v9 v9.4.0 => v9.5.3
go mod tidy output 
go: downloading github.com/ory/dockertest/v3 v3.10.0
go: downloading github.com/sebdah/goldie v0.0.0-20180424091453-8784dd1ab561
go: downloading github.com/jensneuse/diffview v1.0.0
go: downloading gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
go: downloading github.com/evanphx/json-patch/v5 v5.1.0
go: downloading github.com/golang/mock v1.6.0
go: downloading github.com/onsi/ginkgo v1.16.5
go: downloading github.com/onsi/gomega v1.27.10
go: downloading github.com/bsm/ginkgo/v2 v2.12.0
go: downloading github.com/bsm/gomega v1.27.10
go: downloading github.com/hashicorp/consul/proto-public v0.6.1
go: downloading github.com/go-test/deep v1.0.8
go: downloading github.com/99designs/gqlgen v0.17.22
go: downloading github.com/vektah/gqlparser/v2 v2.5.1
go: downloading go.uber.org/goleak v1.2.1
go: downloading github.com/fortytw2/leaktest v1.3.0
go: downloading github.com/ugorji/go/codec v1.2.7
go: downloading gonum.org/v1/gonum v0.14.0
go: downloading github.com/ugorji/go v1.2.7
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/Microsoft/go-winio v0.6.0
go: downloading github.com/docker/go-units v0.4.0
go: downloading github.com/sebdah/goldie/v2 v2.5.3
go: downloading github.com/go-redis/redis v6.15.9+incompatible
go: downloading github.com/go-redis/redis/v7 v7.4.0
go: downloading github.com/gomodule/redigo v1.8.9
go: downloading github.com/redis/rueidis v1.0.19
go: downloading github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203
go: downloading github.com/hashicorp/go-msgpack v0.5.5
go: downloading github.com/hashicorp/memberlist v0.5.0
go: downloading github.com/frankban/quicktest v1.14.6
go: downloading github.com/benbjohnson/clock v1.1.0
go: downloading github.com/jcmturner/goidentity/v6 v6.0.1
go: downloading github.com/logrusorgru/aurora/v3 v3.0.0
go: downloading github.com/docker/cli v20.10.17+incompatible
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/rogpeppe/go-internal v1.11.0
go: downloading github.com/opencontainers/runc v1.1.5
go: downloading github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5
go: downloading github.com/moby/term v0.0.0-20201216013528-df9cb8a40635
go: downloading github.com/opencontainers/image-spec v1.0.2
go: downloading github.com/nxadm/tail v1.4.8
go: downloading github.com/sergi/go-diff v1.1.0
go: downloading github.com/pascaldekloe/goe v0.1.0
go: downloading github.com/google/btree v1.0.1
go: downloading github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529
go: downloading github.com/agnivade/levenshtein v1.1.1
go: downloading github.com/docker/go-connections v0.4.0
go: downloading github.com/containerd/continuity v0.3.0
go: downloading github.com/opencontainers/go-digest v1.0.0
go: downloading gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7
go: downloading github.com/docker/docker v20.10.7+incompatible
go: downloading github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
go: downloading github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161
go: downloading github.com/golang/glog v1.2.0
go: downloading github.com/gogo/protobuf v1.3.2

JIRA: https://tyktech.atlassian.net/browse/TT-12311

@github-actions

github-actions Bot commented Jun 10, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

API Changes

no api changes detected

@github-actions github-actions Bot added the dependencies Pull requests that update a dependency file label Jun 10, 2024
@github-actions

github-actions Bot commented Jun 10, 2024

Copy link
Copy Markdown
Contributor

PR Reviewer Guide 🔍

⏱️ Estimated effort to review [1-5]

2

🧪 Relevant tests

No

🔒 Security concerns

No

⚡ Key issues to review

None

@github-actions

github-actions Bot commented Jun 10, 2024

Copy link
Copy Markdown
Contributor

PR Code Suggestions ✨

CategorySuggestion                                                                                                                                    Score
Best practice
Add the // indirect comment to transitive dependencies

Consider specifying the // indirect comment for the dependency
github.com/cenkalti/backoff/v4 v4.3.0 if it is not directly imported in your Go files.
This helps in clarifying that the dependency is transitive.

go.mod [28]

-github.com/cenkalti/backoff/v4 v4.3.0
+github.com/cenkalti/backoff/v4 v4.3.0 // indirect
Suggestion importance[1-10]: 8

Why: Adding the // indirect comment helps clarify that the dependency is transitive, improving code readability and maintainability. This is a best practice for managing dependencies in Go modules.

8
Possible issue
Review potential breaking changes from major version updates

Review the necessity of updating github.com/hashicorp/vault/api to v1.14.0 as this might
introduce breaking changes or dependencies that are incompatible with other modules in
your project.

go.mod [45]

+github.com/hashicorp/vault/api v1.14.0
 
-
Suggestion importance[1-10]: 7

Why: Reviewing potential breaking changes when updating major versions is important for maintaining compatibility and stability in the project. This suggestion is valid and useful.

7
Verify the compatibility of the updated github.com/IBM/sarama dependency

Consider verifying the compatibility and stability of the newly added
github.com/IBM/sarama v1.43.1 dependency. Major version updates can introduce breaking
changes or new bugs that might affect your project.

go.sum [13-14]

+# Ensure to test thoroughly or consider a more gradual upgrade if issues arise.
 github.com/IBM/sarama v1.43.1 h1:Z5uz65Px7f4DhI/jQqEm/tV9t8aU+JUdTyW/K/fCXpA=
 github.com/IBM/sarama v1.43.1/go.mod h1:GG5q1RURtDNPz8xxJs3mgX6Ytak8Z9eLhAkJPObe2xE=
Suggestion importance[1-10]: 7

Why: The suggestion is valid as major version updates can introduce breaking changes. However, it is a general recommendation and not specific to any observed issue in the PR.

7
Check compatibility of the github.com/cenkalti/backoff/v4 update with other dependencies

Ensure that the update to github.com/cenkalti/backoff/v4 v4.3.0 is compatible with other
project dependencies to avoid conflicts or unexpected behavior.

go.sum [118-119]

+# Check for dependency conflicts with the new version.
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
Suggestion importance[1-10]: 7

Why: This is a reasonable suggestion to ensure that the new version does not conflict with other dependencies. It is a general best practice but not specific to any detected problem in the PR.

7
Confirm compatibility of github.com/hashicorp/consul/api update with project configurations

Confirm that the update to github.com/hashicorp/consul/api v1.29.1 does not disrupt the
existing configurations and integrations within the project.

go.sum [308-309]

+# Ensure compatibility with existing configurations and integrations.
 github.com/hashicorp/consul/api v1.29.1 h1:UEwOjYJrd3lG1x5w7HxDRMGiAUPrb3f103EoeKuuEcc=
 github.com/hashicorp/consul/api v1.29.1/go.mod h1:lumfRkY/coLuqMICkI7Fh3ylMG31mQSRZyef2c5YvJI=
Suggestion importance[1-10]: 7

Why: Ensuring that updates do not disrupt existing configurations is important. This suggestion is valid but is a general recommendation rather than addressing a specific issue in the PR.

7
Review the update necessity and impact of github.com/golang/protobuf

Review the necessity of updating github.com/golang/protobuf to v1.5.4 as frequent minor
updates may introduce instability in the project.

go.sum [268-269]

+# Consider the impact of frequent minor version updates on project stability.
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
Suggestion importance[1-10]: 6

Why: While it is good to be cautious about frequent updates, the suggestion does not point to any specific issue caused by the update. It is a general precautionary note.

6

@github-actions

github-actions Bot commented Jun 10, 2024

Copy link
Copy Markdown
Contributor

💥 CI tests failed 🙈

git-state

all ok

Please look at the run or in the Checks tab.

2 similar comments
@github-actions

github-actions Bot commented Jun 10, 2024

Copy link
Copy Markdown
Contributor

💥 CI tests failed 🙈

git-state

all ok

Please look at the run or in the Checks tab.

@github-actions

github-actions Bot commented Jun 11, 2024

Copy link
Copy Markdown
Contributor

💥 CI tests failed 🙈

git-state

all ok

Please look at the run or in the Checks tab.

@titpetric
titpetric force-pushed the update/TT-12311/update-go-mod-dependencies branch from 87ab772 to 70cc298 Compare June 11, 2024 09:32
@sonarqubecloud

sonarqubecloud Bot commented Jun 11, 2024

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

1 similar comment
@sonarqubecloud

sonarqubecloud Bot commented Jun 11, 2024

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

jeffy-mathew
jeffy-mathew reviewed Jun 13, 2024
View reviewed changes
Comment thread gateway/reverse_proxy_test.go
@jeffy-mathew
jeffy-mathew self-requested a review June 13, 2024 09:07
@titpetric
titpetric merged commit 83db7b0 into master Jun 13, 2024
@titpetric
titpetric deleted the update/TT-12311/update-go-mod-dependencies branch June 13, 2024 09:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jeffy-mathew jeffy-mathew Awaiting requested review from jeffy-mathew
1 more reviewer
@titpetric titpetric titpetric left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file Review effort [1-5]: 2

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@buger @titpetric @jeffy-mathew