chore(deps): Update Go deps (minor + patch) by renovate[bot] · Pull Request #1139 · VMAFx/vmafx

renovate · 2026-08-30T11:59:14Z

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
go (source)	golang	patch	`1.27.0` → `1.27.1`
modernc.org/sqlite	require	minor	`v1.57.0` → `v1.58.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

golang/go (go)

`v1.27.1`

cznic/sqlite (modernc.org/sqlite)

`v1.58.0`

Compare Source

Configuration

📅 Schedule: (in timezone Europe/Vienna)

Branch creation
- "before 6am on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…Actions, gomega (#1141) Sweeps the Renovate PRs that arrived after the 36-PR batch in #1130: #1099 pandas-stubs >=3.0.5.260730 #1118 anthropic >=1.2.0 #1132 ray[tune] >=2.58.0 [SECURITY] #1137 Docker digests (grouped) #1138 GitHub Actions (minor + patch) #1139 onsi/gomega v1.43.0 #1137 arrived as a single grouped PR rather than one per base image — that is the groupName: "Docker digests" rule added in ADR-1123 working as intended. Every hunk is a dependency manifest, Dockerfile pin or workflow action pin; no source is touched. Verified locally before push: go build ./... exit 0 go vet ./pkg/... ./cmd/... exit 0 all pyproject.toml parse (tomllib) changed workflows parse (yaml.safe_load) Co-authored-by: Lusoris <lusoris@pm.me> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

lusoris · 2026-08-30T12:01:10Z

Superseded by the batch PR — included verbatim, one CI run instead of six (ADR-1123).

go-ci.yml pinned go-version: "1.27.0" while go.mod's directive is what Renovate bumps, and GOTOOLCHAIN=local forbids auto-download — so #1139 (go 1.27.0 -> 1.27.1) failed go vet + go test with: go: go.mod requires go >= 1.27.1 (running go 1.27.0; GOTOOLCHAIN=local) Every setup-go step now uses go-version-file: go.mod. actionlint finding count unchanged vs master. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

lusoris · 2026-09-02T10:50:57Z

Holding this one, not closing — the bump is right, CI is what's wrong.

go vet + go test fails with go: go.mod requires go >= 1.27.1 (running go 1.27.0; GOTOOLCHAIN=local) because go-ci.yml hard-pins go-version: "1.27.0" while Renovate bumps the directive in go.mod: the two can never agree on a bump. #1188 switches every setup-go step to go-version-file: go.mod so the directive is the single source of truth. Once #1188 lands and this branch is rebased, this should go green with no change to its own diff.

🤖 Generated with Claude Code

go-ci.yml pinned go-version: "1.27.0" while go.mod's directive is what Renovate bumps, and GOTOOLCHAIN=local forbids auto-download — so #1139 (go 1.27.0 -> 1.27.1) failed go vet + go test with: go: go.mod requires go >= 1.27.1 (running go 1.27.0; GOTOOLCHAIN=local) Every setup-go step now uses go-version-file: go.mod. actionlint finding count unchanged vs master. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…NEO stack as a set (#1188) * chore(renovate): never digest-pin the SLSA generator; bump the Intel NEO stack as a set Two train PRs could never merge, for reasons Renovate cannot know: - #1183 digest-pinned slsa-framework/slsa-github-generator. The generator's README says its reusable workflows MUST be referenced by an exact @vX.Y.Z tag so slsa-verifier can verify the trusted builder (hash-pinned reusable workflows are unsupported, slsa-verifier#12), and the Release Script Contract check (scripts/release/tests/test-publication-environment-binding.sh) enforces the tag form. pinDigests: false for that package; tag bumps still flow. - #1184 bumped intel/gmmlib alone. dev/Containerfile fetches libigdgmm12_${GMMLIB_VER} and the IGC debs from the intel/compute-runtime release page for NEO_VER, so a lone gmmlib bump yields a 404 in the Dev Container Build. compute-runtime, intel-graphics-compiler, gmmlib and level-zero are now one Renovate group; manual review stays (ADR-0605). Verified: renovate.json parses; the untouched release-contract validator still passes on master's tag-form supply-chain.yml. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * ci(go): take the toolchain version from go.mod, not a literal pin go-ci.yml pinned go-version: "1.27.0" while go.mod's directive is what Renovate bumps, and GOTOOLCHAIN=local forbids auto-download — so #1139 (go 1.27.0 -> 1.27.1) failed go vet + go test with: go: go.mod requires go >= 1.27.1 (running go 1.27.0; GOTOOLCHAIN=local) Every setup-go step now uses go-version-file: go.mod. actionlint finding count unchanged vs master. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(changelog): regenerate the Unreleased block from changelog.d/ scripts/release/concat-changelog-fragments.sh --check (Release Script Contract, ADR-1128) fails when a fragment is added without re-rendering CHANGELOG.md. Rendered with --write, not hand-edited (ADR-0221). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Lusoris <lusoris@pm.me> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

renovate Bot requested a review from lusoris as a code owner August 30, 2026 11:59

renovate Bot added the dependencies label Aug 30, 2026

renovate Bot enabled auto-merge (squash) August 30, 2026 11:59

lusoris mentioned this pull request Aug 30, 2026

chore(deps): second dependency batch — ray SECURITY, Docker digests, Actions, gomega #1141

Merged

2 of 6 tasks

lusoris closed this Aug 30, 2026

auto-merge was automatically disabled August 30, 2026 12:01
Pull request was closed

renovate Bot changed the title ~~chore(deps): Update module github.com/onsi/gomega to v1.43.0~~ chore(deps): Update module github.com/onsi/gomega to v1.43.0 - autoclosed Aug 30, 2026

renovate Bot deleted the renovate/go-deps-(minor-+-patch) branch August 30, 2026 12:02

renovate Bot changed the title ~~chore(deps): Update module github.com/onsi/gomega to v1.43.0 - autoclosed~~ chore(deps): Update go module directive to v1.27.1 Sep 2, 2026

renovate Bot reopened this Sep 2, 2026

renovate Bot force-pushed the renovate/go-deps-(minor-+-patch) branch from 02f1174 to 3ab7ce5 Compare September 2, 2026 09:56

chore(deps): Update go module directive to v1.27.1

cb27dee

renovate Bot force-pushed the renovate/go-deps-(minor-+-patch) branch from 3ab7ce5 to cb27dee Compare September 2, 2026 15:29

lusoris merged commit a17bb31 into master Sep 2, 2026
67 of 69 checks passed

renovate Bot changed the title ~~chore(deps): Update go module directive to v1.27.1~~ chore(deps): Update Go deps (minor + patch) Sep 2, 2026

This was referenced Sep 2, 2026

chore(master): release 3.2.1 #1175

Closed

chore(master): release 1.0.0-rc.1 #1213

Merged

lusoris added this to the 1.0.0 — First release milestone Sep 4, 2026

lusoris added the type:chore Maintenance, no user-visible change label Sep 7, 2026

lusoris mentioned this pull request Oct 1, 2026

perf(ai): auto-select /dev/shm for YUV scratch to eliminate NVMe I/O (Win 3) #1688

Merged

4 of 6 tasks

Navigation Menu

Repository navigation

chore(deps): Update Go deps (minor + patch) - #1139

chore(deps): Update Go deps (minor + patch)#1139
lusoris merged 1 commit into
masterfrom
renovate/go-deps-(minor-+-patch)

renovate Bot commented Aug 30, 2026 •

edited

Loading

Uh oh!

lusoris commented Aug 30, 2026

Uh oh!

lusoris commented Sep 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.27.1

v1.58.0

Configuration

Uh oh!

lusoris commented Aug 30, 2026

Uh oh!

lusoris commented Sep 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Aug 30, 2026 •

edited

Loading

`v1.27.1`

`v1.58.0`