Skip to content

[deps] Dependency update: go - #6014

Closed
replicated-software-factory[bot] wants to merge 18 commits into
mainfrom
deps/kots-update-go
Closed

[deps] Dependency update: go#6014
replicated-software-factory[bot] wants to merge 18 commits into
mainfrom
deps/kots-update-go

Conversation

@replicated-software-factory

@replicated-software-factory replicated-software-factory Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

This PR was generated by the kots-update-go Factory workflow.\n\nAutomated Go dependency update.\n\n- github.com/schemahero/schemahero v0.22.1 -> v0.25.1\n- Indirect dependency cleanup in go.mod and go.sum\n- Rebased on current main

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


OpenClaw Bot seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown

Security Review

The legacy-v1 fallback discards host blocked-registry policy, allowing image operations that the host configuration intended to deny.

Reviews (1): Last reviewed commit: "chore(deps): update go dependencies" | Re-trigger Greptile

Comment thread pkg/docker/registry/registriesconf.go
@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown

Reviews (2): Last reviewed commit: "fix(registry): preserve blocked and inse..." | Re-trigger Greptile

@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown

Security Review

Legacy registry policy remains bypassable when v1 conversion fails because the error is discarded and an empty v2 configuration is installed. This can remove blocked-registry enforcement from reachable image operations.

Reviews (3): Last reviewed commit: "fix(deps): pin schemahero to v0.22.1 to ..." | Re-trigger Greptile

Comment thread pkg/docker/registry/registriesconf.go Outdated
@replicated-software-factory
replicated-software-factory Bot force-pushed the deps/kots-update-go branch 3 times, most recently from 29ad1a5 to 9e05dc0 Compare August 7, 2026 05:30
@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown

Reviews (4): Last reviewed commit: "fix(registry): do not silently discard r..." | Re-trigger Greptile

Comment thread pkg/docker/registry/registriesconf.go Outdated
@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown

Reviews (5): Last reviewed commit: "fix(registry): do not silently discard r..." | Re-trigger Greptile

@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown

Reviews (6): Last reviewed commit: "chore(ci): trigger re-run after transien..." | Re-trigger Greptile

Comment thread pkg/docker/registry/registriesconf.go Outdated
@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown

Reviews (7): Last reviewed commit: "chore(ci): trigger re-run after transien..." | Re-trigger Greptile

OpenClaw Bot and others added 12 commits August 9, 2026 05:05
…drivers

schemahero v0.25.1 switched to external plugins for postgres and rqlite, which breaks the in-process schema migrations used by persistence.UpdateDBSchema in both production and integration tests. Pin back to v0.22.1 until the codebase is updated to initialize and distribute schemahero plugins.
…te drivers

schemahero v0.25.1 moved the postgres and rqlite drivers into external
schemahero-postgres/schemahero-rqlite go-plugin binaries. Using those in
persistence.UpdateDBSchema requires building and distributing the plugin
binaries and wiring a PluginManager, which is outside the scope of this Go
dependency update workflow. Pin the library back to v0.22.1 (which still has
in-tree drivers) until that plugin packaging work is done.
Use the host's registries.conf when it is a valid v2 file so that mirrors,

blocked registries, and insecure registries are honored. Only write a

minimal empty v2 file when the host config is missing or in the legacy v1

format.
Automated dependency update for Go ecosystem.

- github.com/schemahero/schemahero v0.22.1 -> v0.25.1
…ng v1 registries.conf

Previously the legacy v1 fallback wrote an empty v2 registries.conf, which discarded host blocked-registry and insecure-registry policy. Now we parse the host v1 file, convert it to v2, and validate the result, falling back to an empty file only if the v1 file has no settings or conversion fails.
ElasticClaw and others added 4 commits August 9, 2026 05:05
…te drivers

schemahero v0.25.1 moved the postgres and rqlite drivers into external schemahero-postgres/schemahero-rqlite go-plugin binaries. The integration database migration test requires in-process drivers, so keep the library at v0.22.1 until plugin packaging is handled.
…sion fails

Previously a host v1 registries.conf that could not be converted to v2 was replaced with an empty v2 file, removing blocked/insecure enforcement. Now conversion failures return an error so callers know the policy would be lost. Empty v1 files and missing host configs still fall back to an empty v2 file.
Dependency update: go
@greptile-apps

greptile-apps Bot commented Aug 9, 2026

Copy link
Copy Markdown

Reviews (8): Last reviewed commit: "chore(deps): update go dependencies" | Re-trigger Greptile

…space handling

Clarify how SetSystemRegistriesConfPath avoids caching transient failures and how TOML parsing handles whitespace in legacy v1 table headers.
@greptile-apps

greptile-apps Bot commented Aug 9, 2026

Copy link
Copy Markdown

Reviews (9): Last reviewed commit: "docs(registry): document registries.conf..." | Re-trigger Greptile

…te drivers

schemahero v0.25.1 moved the postgres and rqlite drivers into external
schemahero-postgres/schemahero-rqlite go-plugin binaries. The integration
database migration test requires in-process drivers, so keep the library at
v0.22.1 until plugin packaging is handled.
@greptile-apps

greptile-apps Bot commented Aug 9, 2026

Copy link
Copy Markdown

Reviews (10): Last reviewed commit: "fix(deps): pin schemahero to v0.22.1 to ..." | Re-trigger Greptile

@xavpaice xavpaice closed this Aug 11, 2026
@replicated-software-factory
replicated-software-factory Bot deleted the deps/kots-update-go branch August 11, 2026 23:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants