chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 - #6678
Conversation
Bumps google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
![ksail-bot[bot]](https://avatars.githubusercontent.com/in/2880167?s=60&v=4){kind=small}
✅MegaLinter analysis: Success✅ Linters with no issuesactionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint Notices
See detailed reports in MegaLinter artifacts
|
Pull request was converted to draft
The desktop module consumes the root module through a local replace directive, so a root-only dependency bump leaves desktop/go.mod still requiring the superseded pseudo-version. go list -deps ./... in desktop then refuses with "updates to go.mod needed", which is what failed the Test, Build, Coverage and Verify Desktop Module Tidy checks. Runs go mod tidy in desktop/ — one indirect requirement and its two go.sum lines. Dependabot targets a single module, so it cannot make this edit itself.
Adapted at
|
| files | go list -deps ./... in desktop |
updates to go.mod needed |
|---|---|---|
| pre-tidy (this PR's old head) | exit 1 | present |
| tidied | exit 0 | absent |
2. A separate transient I ruled out rather than re-ran blind
🧩 Verify Desktop Module Tidy also reported, at 17:26:52Z, a checksum mismatch on the unrelated
github.com/anchore/go-macholibre@v0.1.0:
This download does NOT match an earlier download recorded in go.sum.
That reads alarming, so it is worth stating what it was not. The authoritative Go checksum database
records h1:qHbdusBZNcZM/uuKf1Psa9xxAFSoyRTps8GW9gpJgsg= for that version, which is exactly what
this repository's go.sum already contains — it was the downloaded bytes that differed. So the
repository is correct, the module was not re-published, and Go's tamper-evidence did its job on a
corrupt proxy response. It landed inside the GitHub Actions incident window (opened 15:11:58Z), which
is the most likely explanation. No change is warranted for it; it should not recur on this head.
Both causes had to be separated before acting: re-running would not have fixed the first, and editing
go.sum would have been the wrong response to the second.
This started as a Dependabot bump but carries an agent-authored adaptation commit, which restores the normal semantic-review gate rather than the untouched-bot-head exemption. The adaptation propagates the same @coderabbitai review |
|
✅ Action performedReview finished.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📜 Recent review details🔇 Additional comments (2)
📝 WalkthroughWalkthroughUpdated the Merge Risk: ⚪ Minimal · up to This is a localized dependency metadata update with no actionable merge-blocking risk remaining after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Readiness at Programmatically tested — 58 successful checks, 16 skipped, 0 failing, 0 pending. Reviewed — CodeRabbit green at this head: its auto-generated summary naming the full head was refreshed at 20:13:17Z, after this round's request marker at 20:10:22Z, carrying no rate-limit or service marker; the head's Tried and evaluated as a user — this bump has a real runtime surface, and CI exercises it rather than only compiling it: the head ran the full System Test (Docker) matrix, which provisions actual clusters across Talos, K3s, Vanilla, VCluster and KWOK with Cilium/Calico and Flux/ArgoCD, using the binary built against protobuf 1.36.12 in both modules. All passed. I read that matrix as the observation, not the build step. Note on ownership: this PR was opened by Dependabot, but its head is an agent-authored adaptation propagating the same version into the |
1 participant
Bumps google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)