Skip to content

chore(deps): update module sigs.k8s.io/structured-merge-diff/v6 to v7 - #367

Open
red-hat-konflux-kflux-prd-rh03[bot] wants to merge 1 commit into
masterfrom
konflux/mintmaker/master/sigs.k8s.io-structured-merge-diff-v6-7.x
Open

red-hat-konflux-kflux-prd-rh03[bot] wants to merge 1 commit into
masterfrom
konflux/mintmaker/master/sigs.k8s.io-structured-merge-diff-v6-7.x

Conversation

@red-hat-konflux-kflux-prd-rh03

@red-hat-konflux-kflux-prd-rh03 red-hat-konflux-kflux-prd-rh03 Bot commented Sep 8, 2026

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
sigs.k8s.io/structured-merge-diff/v6 v6.4.0v7.0.0 age confidence

Release Notes

kubernetes-sigs/structured-merge-diff (sigs.k8s.io/structured-merge-diff/v6)

v7.0.0

Compare Source

  • Updates to Go 1.27
  • Switches from json-iterator serialization to stdlib json/v2 serialization

v6.4.2

Compare Source

v6.4.1

Compare Source


Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • Between 02:00 AM and 04:59 AM, Monday through Friday (* 2-4 * * 1-5)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.


Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Signed-off-by: red-hat-konflux-kflux-prd-rh03 <206760901+red-hat-konflux-kflux-prd-rh03[bot]@users.noreply.github.com>
@red-hat-konflux-kflux-prd-rh03 red-hat-konflux-kflux-prd-rh03 Bot added area/dependency Issues or PRs related to dependency changes major-update manual-review-required ok-to-test Indicates a non-member PR verified by an org member that is safe to test. labels Sep 8, 2026
@red-hat-konflux-kflux-prd-rh03

Copy link
Copy Markdown
Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 16 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.26.0 -> 1.27
golang.org/x/net v0.56.0 -> v0.56.0
github.com/go-openapi/swag/cmdutils v0.27.0 -> v0.27.0
github.com/go-openapi/swag/conv v0.27.0 -> v0.27.0
github.com/go-openapi/swag/fileutils v0.27.0 -> v0.27.0
github.com/go-openapi/swag/jsonutils v0.27.0 -> v0.27.0
github.com/go-openapi/swag/loading v0.27.0 -> v0.27.0
github.com/go-openapi/swag/mangling v0.27.0 -> v0.27.0
github.com/go-openapi/swag/netutils v0.27.0 -> v0.27.0
github.com/go-task/slim-sprig/v3 v3.0.0 -> v3.0.0
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 -> v1.5.4-0.20250319132907-e064f32e3674
github.com/kylelemons/godebug v1.1.0 -> v1.1.0
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f -> v0.0.0-20140419014527-cca7078d478f
github.com/x448/float16 v0.8.4 -> v0.8.4
golang.org/x/sync v0.21.0 -> v0.21.0
github.com/beorn7/perks v1.0.1 -> v1.0.1
github.com/cespare/xxhash/v2 v2.3.0 -> v2.3.0

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 8, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 4:11 AM UTC · Completed 4:27 AM UTC

Commit: 0c97e87 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.11

@openshift-ci
openshift-ci Bot requested review from typeid and xiaoyu74 September 8, 2026 04:20
@openshift-ci

openshift-ci Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Hi @red-hat-konflux-kflux-prd-rh03[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci

openshift-ci Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux-kflux-prd-rh03[bot]
Once this PR has been reviewed and has the lgtm label, please assign charlesgong for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@fullsend-ai-review fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Sep 8, 2026
@fullsend-ai-review

Copy link
Copy Markdown

Risk Assessment: moderate (2/5)

Details

Bot-authored dependency update claiming a major version bump (v6 to v7) confined to go.mod (1 file, 71 lines). While metadata signals are low-risk (bot author, single file, no protected paths), the major-update and manual-review-required labels elevate concern. Low churn and no reverts are positive signals. Overall risk is moderate due to the major version bump classification.

@fullsend-ai-review

Copy link
Copy Markdown

Review

Findings

Critical

  • [api-contract] go.mod — PR title claims to update sigs.k8s.io/structured-merge-diff/v6 to v7, but the diff does not perform this update. The dependency remains at sigs.k8s.io/structured-merge-diff/v6 v6.4.0 in both the base and PR head. The v7 module path (sigs.k8s.io/structured-merge-diff/v7) does not appear anywhere. The PR only reorganizes existing indirect dependencies into a single require block, bumps the Go directive from 1.26.0 to 1.27, and consolidates three already-direct dependencies into the main require block. The stated purpose of the PR is completely unachieved.
    Remediation: Either (a) actually update the dependency to sigs.k8s.io/structured-merge-diff/v7 v7.0.0 by changing the import path in go.mod and all Go source files that reference the v6 package, then run go mod tidy and update go.sum, or (b) close this PR and open one with an accurate title/description reflecting the actual changes.

Medium

  • [logic-error] go.mod:3 — The Go directive is bumped from go 1.26.0 to go 1.27 without updating go.sum. Running go mod tidy with the Go 1.27 toolchain may produce different checksums or resolve different transitive dependencies, potentially causing build failures for anyone checking out this branch.
    Remediation: Run go mod tidy with the Go 1.27 toolchain and include the resulting go.sum changes in the PR. Verify the project builds and tests pass with Go 1.27.

  • [scope-creep] go.mod — The diff includes changes unrelated to any structured-merge-diff update: (1) Go directive bumped from 1.26.0 to 1.27, (2) require blocks consolidated from four blocks into two, (3) golang.org/x/net moved from the direct require block to the indirect block. Since the claimed v6-to-v7 update was not performed at all, the PR's actual content is entirely disconnected from its stated purpose.

Low

  • [pattern-violation] go.mod:99 — Pre-existing duplicate // indirect; // indirect comment on the k8s.io/gengo/v2 line carried forward without cleanup during require block consolidation.
    Remediation: Run go mod tidy to normalize go.mod formatting.

  • [authorization-trace] go.mod — The linked issue (Dependency Dashboard #187) is a generic Renovate Dependency Dashboard. The authorization was for the actual v6-to-v7 migration, not for the cosmetic-only changes delivered in this diff.

  • [code-organization] go.mod:12 — Dependencies consolidated from multiple require blocks into two (direct + indirect). Running go mod tidy would ensure correct direct/indirect classification.
    Remediation: Run go mod tidy to let the Go toolchain determine the correct direct/indirect classification automatically.


Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread go.mod
module github.com/openshift/ocm-agent-operator

go 1.26.0
go 1.27

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] logic-error

Go directive bumped from go 1.26.0 to go 1.27 without updating go.sum. Running go mod tidy with Go 1.27 may produce different checksums or resolve different transitive dependencies, potentially causing build failures.

Suggested fix: Run go mod tidy with the Go 1.27 toolchain and include the resulting go.sum changes in the PR. Verify the project builds and tests pass with Go 1.27.

Comment thread go.mod
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.36.0 // indirect
k8s.io/code-generator v0.36.0 // indirect

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] pattern-violation

Pre-existing duplicate '// indirect; // indirect' comment on k8s.io/gengo/v2 carried forward without cleanup during require block consolidation.

Suggested fix: Run go mod tidy to normalize go.mod formatting.

Comment thread go.mod
@@ -10,11 +10,13 @@ require (
github.com/onsi/gomega v1.42.1
github.com/openshift/api v0.0.0-20260317095243-5c75e62da3e7
github.com/openshift/operator-custom-metrics v0.5.1

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] code-organization

Dependencies consolidated from multiple require blocks into two (direct + indirect). Running go mod tidy would ensure correct direct/indirect classification.

Suggested fix: Run go mod tidy to let the Go toolchain determine the correct direct/indirect classification automatically.

@openshift-ci

openshift-ci Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

@red-hat-konflux-kflux-prd-rh03[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/rosa-sts-e2e 0c97e87 link true /test rosa-sts-e2e
ci/prow/osd-gcp-e2e 0c97e87 link true /test osd-gcp-e2e

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@codecov-commenter

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.26%. Comparing base (c6e16cb) to head (0c97e87).

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #367      +/-   ##
==========================================
+ Coverage   65.60%   70.26%   +4.65%     
==========================================
  Files          23       23              
  Lines        1608     1419     -189     
==========================================
- Hits         1055      997      -58     
+ Misses        473      422      -51     
+ Partials       80        0      -80     

see 23 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/dependency Issues or PRs related to dependency changes major-update manual-review-required ok-to-test Indicates a non-member PR verified by an org member that is safe to test. risk/moderate PR risk: moderate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant