Skip to content

chore(deps): bump the go-dependencies group across 1 directory with 13 updates - #1154

Open
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/go_modules/go-dependencies-60d4d05e7b
Open

chore(deps): bump the go-dependencies group across 1 directory with 13 updates#1154
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/go_modules/go-dependencies-60d4d05e7b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 11 updates in the / directory:

Package From To
github.com/aws/aws-sdk-go-v2 1.45.1 1.46.0
github.com/aws/aws-sdk-go-v2/config 1.33.1 1.33.3
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager 0.4.1 0.4.3
github.com/aws/aws-sdk-go-v2/service/ecs 1.93.0 1.96.0
github.com/aws/aws-sdk-go-v2/service/lambda 1.104.1 1.107.0
github.com/go-playground/validator/v10 10.30.3 10.30.4
github.com/moby/moby/api 1.55.0 1.56.0
github.com/moby/moby/client 0.5.1 0.6.0
github.com/open-policy-agent/opa 1.20.1 1.20.2
golang.org/x/oauth2 0.36.0 0.37.0
google.golang.org/api 0.295.0 0.297.0

Updates github.com/aws/aws-sdk-go-v2 from 1.45.1 to 1.46.0

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.1 to 1.33.3

Commits

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.1 to 1.20.3

Commits

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.1 to 0.4.3

Commits

Updates github.com/aws/aws-sdk-go-v2/service/ecs from 1.93.0 to 1.96.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/lambda from 1.104.1 to 1.107.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.109.1 to 1.111.0

Commits

Updates github.com/go-playground/validator/v10 from 10.30.3 to 10.30.4

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

v10.30.4

What's Changed

New Contributors

Full Changelog: go-playground/validator@v10.30.3...v10.30.4

Commits
  • dfe35cf ci: Fix the linter version (#1617)
  • facf128 feat(translations): add Armenian translations (#1604)
  • 961375b docs: clarify fieldexcludes behavior (#1610)
  • 74dd82a test: cover startsnotwith/endsnotwith, RegisterStructValidationMapRules, and ...
  • 379edc8 chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#1612)
  • f9944c5 fix: use idiomatic "at most" in English max/lte messages (#1600)
  • 67e37d6 fix(fqdn): enforce maximum DNS name length (#1603)
  • 6b571d1 chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.15 (#...
  • 8455180 chore(deps): bump github.com/leodido/go-urn from 1.4.0 to 1.5.0 (#1606)
  • fd8bd3c chore(deps): bump actions/setup-go from 6 to 7 (#1601)
  • Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.55.0 to 1.56.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.56.0

1.56.0

Changelog

  • GET /containers/json now supports an annotation filter to filter containers by annotation, either by key (annotation=key) or by key and value (annotation="key=value"), similar to the existing label filter. moby/moby#53538
  • POST /containers/create now supports HostConfig.Umask to set the initial umask for a Unix container. When set, the daemon includes the value in the OCI process configuration for the container's entrypoint, exec processes, and healthchecks. When omitted, the runtime's default behavior applies.moby/moby#53463
  • api/docs: sync API docs v1.25 - v1.55. moby/moby#53246
  • api/swagger: Align Healthcheck name with Go struct. moby/moby#53567
  • api/types/plugin: Deprecated plugin.Privileges sorting methods in favor of slices.SortFunc. moby/moby#53511
  • api/types/plugin: fix Privileges Swap implementation. moby/moby#53510
  • api: Bump to 1.56. moby/moby#53425
  • api: document Task.NetworksAttachments in the swagger definition. moby/moby#53082
  • api: remove gotest.tools from tests. moby/moby#53535
  • api: swagger: Use int64 for build query params. moby/moby#53520
  • api: use blackbox testing. moby/moby#53525
  • Fix API reference documenting an unsupported names filter for GET /configs. moby/moby#53447
Commits
  • 9b2179d Merge pull request #53572 from vvoland/api-docs-cut
  • 575cf82 Merge pull request #53571 from thaJeztah/bump_tools
  • 20beedb api/docs: Cut v1.56
  • bb86302 Merge pull request #53569 from vvoland/afvsock-lsm
  • 65be55a Merge pull request #53513 from thaJeztah/daemon_fix_list
  • 0af79c4 Merge pull request #53570 from vvoland/process-release
  • 7d1ce6a Merge pull request #53568 from renovate-bot/renovate/github.com-mdlayher-sock...
  • 0df1a00 Dockerfile: update cli v29.7.2, compose v5.5.1, buildx v0.37.0
  • e1d06bd Drop replace rules
  • b40d37e Merge pull request #53359 from vvoland/ext-namegenerator
  • Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.5.1 to 0.6.0

Release notes

Sourced from github.com/moby/moby/client's releases.

client/v0.6.0

0.6.0

Changelog

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.6.0 (2013-08-22)

  • Runtime: Load authConfig only when needed and fix useless WARNING
  • Runtime: Add lxc-conf flag to allow custom lxc options
  • Runtime: Fix race conditions in parallel pull
  • Runtime: Improve CMD, ENTRYPOINT, and attach docs.
  • Documentation: Small fix to docs regarding adding docker groups
  • Documentation: Add MongoDB image example
  • Builder: Add USER instruction do Dockerfile
  • Documentation: updated default -H docs
  • Remote API: Sort Images by most recent creation date.
  • Builder: Add workdir support for the Buildfile
  • Runtime: Add an option to set the working directory
  • Runtime: Show tag used when image is missing
  • Documentation: Update readme with dependencies for building
  • Documentation: Add instructions for creating and using the docker group
  • Remote API: Reworking opaque requests in registry module
  • Runtime: Fix Graph ByParent() to generate list of child images per parent image.
  • Runtime: Add Image name to LogEvent tests
  • Documentation: Add sudo to examples and installation to documentation
  • Hack: Bash Completion: Limit commands to containers of a relevant state
  • Remote API: Add image name in /events
  • Runtime: Apply volumes-from before creating volumes
  • Runtime: Make docker run handle SIGINT/SIGTERM
  • Runtime: Prevent crash when .dockercfg not readable
  • Hack: Add docker dependencies coverage testing into docker-ci
  • Runtime: Add -privileged flag and relevant tests, docs, and examples
  • Packaging: Docker-brew 0.5.2 support and memory footprint reduction
  • Runtime: Install script should be fetched over https, not http.
  • Packaging: Add new docker dependencies into docker-ci
  • Runtime: Use Go 1.1.2 for dockerbuilder
  • Registry: Improve auth push
  • Runtime: API, issue 1471: Use groups for socket permissions
  • Documentation: PostgreSQL service example in documentation
  • Contrib: bash completion script
  • Tests: Improve TestKillDifferentUser to prevent timeout on buildbot
  • Documentation: Fix typo in docs for docker run -dns
  • Documentation: Adding a reference to ps -a
  • Runtime: Correctly detect IPv4 forwarding
  • Packaging: Revert "docker.upstart: avoid spawning a sh process"
  • Runtime: Use ranged for loop on channels
  • Runtime: Fix typo: fmt.Sprint -> fmt.Sprintf
  • Tests: Fix typo in TestBindMounts (runContainer called without image)
  • Runtime: add websocket support to /container//attach/ws
  • Runtime: Mount /dev/shm as a tmpfs
  • Builder: Only count known instructions as build steps
  • Builder: Fix docker build and docker events output
  • Runtime: switch from http to https for get.docker.io
  • Tests: Improve TestGetContainersTop so it does not rely on sleep
  • Packaging: Docker-brew and Docker standard library
  • Testing: Add some tests in server and utils

... (truncated)

Commits
  • f4a4f1c Bump to 0.6.0
  • f925edd Merge pull request #1525 from griff/1503-fix
  • 12715c8 Merge pull request #1609 from jpetazzo/release-docker-with-docker
  • 326dadd Merge pull request #1565 from dotcloud/only_load_authconfig_when_needed
  • a3510c9 Merge pull request #1560 from dotcloud/439-allow-lxc-args
  • 262d57e Merge pull request #1623 from mhennings/1592-fix-race-conditions-in-parallel-...
  • 551092f Add lxc-conf flag to allow custom lxc options
  • 3f802f4 Fix race conditions in parallel pull
  • 0b9c8e2 Merge pull request #1596 from metalivedev/1149-easyfixes
  • 42fe550 Merge pull request #1614 from denibertovic/docs
  • Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa from 1.20.1 to 1.20.2

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.20.2

This release includes a bug fix for a parser regression introduced in v1.20.0, and dependency updates.

Fix stale parse errors on statements starting with { (#9140)

When the and/or keywords added in v1.20.0 are imported, a statement that starts with { is first read as an explicit operand body, and re-read as a term (a comprehension, for example) if no and or or follows. Errors recorded during the abandoned first attempt stayed in the parser's term cache and were reported against the successful re-read, rejecting policies that parse fine:

package example
import future.keywords
xs := [1, 2, 3]
allow if {
{
y |
some y in xs # rego_parse_error: unexpected some keyword
} == {1, 2, 3}
}

The term cache is now restored along with the rest of the parser state when the operand-body guess is abandoned. Only policies importing and or or — directly or via import future.keywords — were affected; policies that don't import them parse unchanged.

Authored by @​sspaink

Miscellaneous

  • build(go): Bump to 1.27.1 (3652eeb) authored by @​srenatus
  • Dependency updates; notably:
    • build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
    • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0
    • build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
    • build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
    • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/trace from 1.44.0 to 1.46.0

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.20.2

This release includes a bug fix for a parser regression introduced in v1.20.0, and dependency updates.

Fix stale parse errors on statements starting with { (#9140)

When the and/or keywords added in v1.20.0 are imported, a statement that starts with { is first read as an explicit operand body, and re-read as a term (a comprehension, for example) if no and or or follows. Errors recorded during the abandoned first attempt stayed in the parser's term cache and were reported against the successful re-read, rejecting policies that parse fine:

package example
import future.keywords
xs := [1, 2, 3]
allow if {
{
y |
some y in xs # rego_parse_error: unexpected some keyword
} == {1, 2, 3}
}

The term cache is now restored along with the rest of the parser state when the operand-body guess is abandoned. Only policies importing and or or — directly or via import future.keywords — were affected; policies that don't import them parse unchanged.

Authored by @​sspaink

Miscellaneous

  • build(go): Bump to 1.27.1 (3652eeb) authored by @​srenatus
  • Dependency updates; notably:
    • build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
    • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0
    • build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
    • build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
    • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0

... (truncated)

Commits

Updates golang.org/x/oauth2 from 0.36.0 to 0.37.0

Commits
  • c624b89 google: change the snake case endpoint to kebab-case
  • 09a82f6 all: upgrade go directive to at least 1.26.0 [generated]
  • See full diff in compare view

Updates google.golang.org/api from 0.295.0 to 0.297.0

Release notes

Sourced from google.golang.org/api's releases.

v0.297.0

0.297.0 (2026-09-01)

Features

  • Move to go1.26.0 as the lowest supported go version (#3724) (7770e01)

v0.296.0

0.296.0 (2026-08-31)

Features

Changelog

Sourced from google.golang.org/api's changelog.

0.297.0 (2026-09-01)

Features

  • Move to go1.26.0 as the lowest supported go version (#3724) (7770e01)

0.296.0 (2026-08-31)

Features

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 9, 2026
@github-actions github-actions Bot removed the go Pull requests that update go code label Sep 9, 2026
@claude

claude Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Claude finished @mbevc1's task in 3m 24s —— View job


Review: dependency bump + snapshotPaths golden fix

  • Gather context (diff, prior review threads)
  • Static analysis: go build ./..., go vet ./..., go mod tidy drift
  • Review the snapshotPaths_test.go change
  • Post review

Phase 1 — Static analysis

Check Result
go build ./... ✅ clean
go vet ./... ✅ clean
go mod tidygit diff --exit-code go.mod go.sum ✅ no drift

A clean build settles the two risks I raised on the earlier push: the moby/moby/client v0.5.1 → v0.6.0 pre-1.0 bump (client.New, the Image*Options/Container*Options structs used in internal/docker/docker.go and cmd/kosli/snapshotDocker.go) and the ECS/Lambda/S3 client regenerations. No call-site changes needed. go.mod declares go 1.26.7, which satisfies the new go1.26.0 floor that google.golang.org/api v0.297.0 and golang.org/x/oauth2 v0.37.0 introduced.

All direct bumps are patch/minor: aws-sdk-go-v2 core + config/credentials/transfermanager/ecs/lambda/s3, validator v10.30.4, moby api/client, OPA 1.20.2, oauth2, google api. Nothing requires a code change.

Phase 2 — The test fix

cmd/kosli/snapshotPaths_test.go:46correct fix, correct reason, and the two nits from my earlier comments are both addressed. Verified the root cause directly in the module cache: go-viper/mapstructure v2.5.0 added at mapstructure.go:1752-1756

// Improve error message when name is empty by showing the target struct type
// in the case where it is empty for embedded structs.
errorName := name
if errorName == "" {
    errorName = val.Type().String()
}

so the top-level unused-keys error went from '' has invalid keys: … to 'server.PathsSpec' has invalid keys: …. Everything else in the string is stable: the wrapper text is a literal at mapstructure.go:538, and the key list is sort.Strings-sorted at mapstructure.go:1750, so foo, versionnn stays deterministic. The \A/\z anchors keep this an exact-output assertion rather than the substring match require.Regexp would otherwise give (cmd/kosli/testHelpers.go:126), and '[^']*' scopes the wildcard to the quoted name. The comment explains why the segment is loose without restating the regex. Good.

I also checked the adjacent blast radius:

  • No other golden in the repo asserts mapstructure's has invalid keys / has unset fields text — this was the only one.
  • validator v10.30.4 reworded its English translations (no more thanat most) and tightened fqdn, but cmd/kosli/snapshotPaths.go:150 prints validate.Struct errors raw (Key: 'PathsSpec.Version' Error:Field validation …), not via ut translations, and no struct tag in the repo uses fqdn/urn/hostname — so snapshotPaths_test.go:52 is unaffected.

One thing to resolve before merging

The test suite did not run on the head commit. Main (run 34505898343) shows pre-build, init-kosli, test and docker all skipped. The gate at .github/workflows/main.yml:15 is:

if: github.event_name == 'push' || github.actor == 'dependabot[bot]'

and push is excluded for this branch by branches-ignore: dependabot/** (main.yml:5-6). Because the last two commits were pushed by claude[bot] rather than dependabot, github.actor no longer matches and the whole test pipeline no-ops. PR checks (34505900706) passed, but that workflow only does conventional-commit title validation and labeling — it runs no tests.

So the fix is verified by source reading, not by execution. Please run it locally before merging:

make test_integration_single TARGET=SnapshotPathsTestSuite

I could not run it here — go test and make test_integration_single both need approval in this sandbox (the suite also needs the docker-compose Kosli server on localhost:8001). If you'd like me to run it on future pushes, add Bash(go test:*) and Bash(make test_integration_single:*) to --allowedTools.

Nice work

Two things worth calling out. First, the diagnosis: '''server.PathsSpec' is an easy failure to "fix" by pasting the new string into the golden, which would just re-break on the next mapstructure release. Loosening exactly the volatile segment and keeping the rest byte-exact is the durable version. Second, the follow-up commit that anchored the regex — goldenRegex is a genuine strictness downgrade from golden because require.Regexp is unanchored, and \A/\z buys back everything except the struct name. TODO.md correctly has no stale section for this.
· branch dependabot/go_modules/go-dependencies-60d4d05e7b

@github-actions github-actions Bot added the chore label Sep 9, 2026
Comment thread go.mod
github.com/go-playground/universal-translator v0.18.1 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Highest-risk bump in this PR, and it isn't in the description's table.

cmd/kosli/snapshotPaths.go:146 decodes the paths spec via viper.UnmarshalExact, which surfaces go-viper/mapstructure's ErrorUnused text verbatim. cmd/kosli/snapshotPaths_test.go:43 asserts that string exactly:

Error: failed to unmarshal path spec file [testdata/paths-files/invalid-pathsfile.yml] : decoding failed due to the following error(s):

'' has invalid keys: foo, versionnn

Any rewording in mapstructure v2.5.0's unused-keys error breaks that golden. Worth running make test_integration_single TARGET=SnapshotPathsTestSuite before merging.

Comment thread go.mod
github.com/moby/moby/client v0.5.1
github.com/open-policy-agent/opa v1.20.1
github.com/moby/moby/api v1.56.0
github.com/moby/moby/client v0.6.0

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pre-1.0 module, so a minor bump carries no API-stability guarantee, and the release notes list a "minor cleanups, refactors" PR (moby/moby#53509).

This repo leans on a fairly wide slice of that surface:

  • client.New(client.FromEnv)internal/docker/docker.go:17, internal/digest/digest.go:331, cmd/kosli/snapshotDocker.go:103
  • client.ImagePullOptions / ImagePushOptions / ImageTagOptions / ImageRemoveOptionsinternal/docker/docker.go:27,56,82,93
  • client.ContainerCreateOptions / ContainerStartOptions / ContainerRemoveOptionsinternal/docker/docker.go:108,119,130
  • client.ContainerListOptionscmd/kosli/snapshotDocker.go:108

A clean go build ./... fully settles this one — if it compiles, there's nothing further to check here.

…3 updates

Bumps the go-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.45.1` | `1.46.0` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.1` | `1.33.3` |
| [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2) | `0.4.1` | `0.4.3` |
| [github.com/aws/aws-sdk-go-v2/service/ecs](https://github.com/aws/aws-sdk-go-v2) | `1.93.0` | `1.96.0` |
| [github.com/aws/aws-sdk-go-v2/service/lambda](https://github.com/aws/aws-sdk-go-v2) | `1.104.1` | `1.107.0` |
| [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) | `10.30.3` | `10.30.4` |
| [github.com/moby/moby/api](https://github.com/moby/moby) | `1.55.0` | `1.56.0` |
| [github.com/moby/moby/client](https://github.com/moby/moby) | `0.5.1` | `0.6.0` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.20.1` | `1.20.2` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.36.0` | `0.37.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.295.0` | `0.297.0` |



Updates `github.com/aws/aws-sdk-go-v2` from 1.45.1 to 1.46.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.45.1...v1.46.0)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.1 to 1.33.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.33.1...config/v1.33.3)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.20.1 to 1.20.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.20.1...v1.20.3)

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager` from 0.4.1 to 0.4.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@feature/s3/transfermanager/v0.4.1...feature/s3/transfermanager/v0.4.3)

Updates `github.com/aws/aws-sdk-go-v2/service/ecs` from 1.93.0 to 1.96.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.93.0...service/s3/v1.96.0)

Updates `github.com/aws/aws-sdk-go-v2/service/lambda` from 1.104.1 to 1.107.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.104.1...service/s3/v1.107.0)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.109.1 to 1.111.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.109.1...service/s3/v1.111.0)

Updates `github.com/go-playground/validator/v10` from 10.30.3 to 10.30.4
- [Release notes](https://github.com/go-playground/validator/releases)
- [Commits](go-playground/validator@v10.30.3...v10.30.4)

Updates `github.com/moby/moby/api` from 1.55.0 to 1.56.0
- [Release notes](https://github.com/moby/moby/releases)
- [Commits](moby/moby@api/v1.55.0...api/v1.56.0)

Updates `github.com/moby/moby/client` from 0.5.1 to 0.6.0
- [Release notes](https://github.com/moby/moby/releases)
- [Changelog](https://github.com/moby/moby/blob/v0.6.0/CHANGELOG.md)
- [Commits](moby/moby@v0.5.1...v0.6.0)

Updates `github.com/open-policy-agent/opa` from 1.20.1 to 1.20.2
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.20.1...v1.20.2)

Updates `golang.org/x/oauth2` from 0.36.0 to 0.37.0
- [Commits](golang/oauth2@v0.36.0...v0.37.0)

Updates `google.golang.org/api` from 0.295.0 to 0.297.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.295.0...v0.297.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.20.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager
  dependency-version: 0.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecs
  dependency-version: 1.96.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/lambda
  dependency-version: 1.107.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.111.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/go-playground/validator/v10
  dependency-version: 10.30.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/moby/moby/api
  dependency-version: 1.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/moby/moby/client
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/api
  dependency-version: 0.297.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-dependencies-60d4d05e7b branch from e803fdc to 76e00e2 Compare September 9, 2026 19:02
go-viper/mapstructure v2.5.0 now includes the target struct's type name in
the ErrorUnused message, where v2.4.0 left it empty:

  ''                   has invalid keys: foo, versionnn
  'server.PathsSpec'   has invalid keys: foo, versionnn

The name comes from a transitive dependency's error format and is not part
of the CLI's contract, so switch the exact golden to a goldenRegex that
accepts either form.
@github-actions github-actions Bot added the go Pull requests that update go code label Sep 9, 2026
Comment thread cmd/kosli/snapshotPaths_test.go Outdated
cmd: fmt.Sprintf(`snapshot paths --paths-file testdata/paths-files/invalid-pathsfile.yml %s %s`, suite.envName, suite.defaultKosliArguments),
golden: "Error: failed to unmarshal path spec file [testdata/paths-files/invalid-pathsfile.yml] : decoding failed due to the following error(s):\n\n'' has invalid keys: foo, versionnn\n",
// the struct name in the mapstructure error is not part of our contract, so match it loosely
goldenRegex: "Error: failed to unmarshal path spec file \\[testdata\\/paths-files\\/invalid-pathsfile\\.yml\\] : decoding failed due to the following error\\(s\\):\n\n'.*' has invalid keys: foo, versionnn\n",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed this is the right fix, and for the right reason. In go-viper/mapstructure v2.5.0, mapstructure.go:1752-1757 added:

// Improve error message when name is empty by showing the target struct type
errorName := name
if errorName == "" {
    errorName = val.Type().String()
}

so the top-level '' in the old golden is now 'server.PathsSpec'. The key list is still sorted (sort.Strings at mapstructure.go:1750), so foo, versionnn stays deterministic — the only volatile part is exactly what you loosened.

Two small notes:

  • goldenRegex goes through require.Regexp (cmd/kosli/testHelpers.go:126), which is an unanchored match, so this is a substring assertion rather than the exact-output check golden gave you. Adding \\A would restore the strictness for everything before the volatile segment, matching what evaluateInput_test.go:176 does.
  • Optional: '[^']*' instead of '.*' narrows the wildcard to the quoted name and can't swallow adjacent text.

Neither is blocking — the escaping style and looseness match the sibling case on line 37.

Comment thread cmd/kosli/snapshotPaths_test.go Outdated
cmd: fmt.Sprintf(`snapshot paths --paths-file testdata/paths-files/invalid-pathsfile.yml %s %s`, suite.envName, suite.defaultKosliArguments),
golden: "Error: failed to unmarshal path spec file [testdata/paths-files/invalid-pathsfile.yml] : decoding failed due to the following error(s):\n\n'' has invalid keys: foo, versionnn\n",
// the struct name in the mapstructure error is not part of our contract, so match it loosely
goldenRegex: "Error: failed to unmarshal path spec file \\[testdata\\/paths-files\\/invalid-pathsfile\\.yml\\] : decoding failed due to the following error\\(s\\):\n\n'.*' has invalid keys: foo, versionnn\n",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed this is the right fix, and confirmed why the old golden broke. mapstructure v2.5.0 added a fallback when the decode-error name is empty (mapstructure.go:1752-1757):

// Improve error message when name is empty by showing the target struct type
// in the case where it is empty for embedded structs.
errorName := name
if errorName == "" {
    errorName = val.Type().String()
}

DecodeError.Error() renders '%s' %s, so the top-level unused-keys message went from '' has invalid keys: … to 'server.PathsSpec' has invalid keys: …. The '.*' here matches both, and the struct type genuinely isn't part of the CLI's contract — good call keeping the rest of the string exact.

Two optional nits:

  1. require.Regexp is an unanchored substring match (testHelpers.go:126), so this is a weaker assertion than the golden it replaced — trailing/leading noise would no longer fail the test. The repo already anchors elsewhere (evaluateInput_test.go:176 uses \A).
  2. A raw string literal avoids the doubled backslashes, and / needs no escaping in Go regexp.
Suggested change
goldenRegex: "Error: failed to unmarshal path spec file \\[testdata\\/paths-files\\/invalid-pathsfile\\.yml\\] : decoding failed due to the following error\\(s\\):\n\n'.*' has invalid keys: foo, versionnn\n",
// the struct name in the mapstructure error is not part of our contract, so match it loosely
goldenRegex: `\AError: failed to unmarshal path spec file \[testdata/paths-files/invalid-pathsfile\.yml\] : decoding failed due to the following error\(s\):\n\n'.*' has invalid keys: foo, versionnn\n\z`,

goldenRegex goes through require.Regexp, which is an unanchored search, so
the previous pattern was a substring assertion rather than the exact-output
check the golden it replaced gave us. Anchor with \A and \z to restore that,
and narrow the wildcard to '[^']*' so it cannot span the quoted name.

Switch to a raw string literal, matching evaluateInput_test.go.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

chore dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant