[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
github.com/cncf/xds/go	indirect	digest	ae57f3c → dba9d58

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/go.sum

Command failed: go get -t ./...
go: downloading github.com/sirupsen/logrus v1.9.3
go: downloading github.com/spf13/viper v1.8.1
go: downloading github.com/stretchr/testify v1.10.0
go: downloading github.com/cockroachdb/errors v1.11.1
go: downloading github.com/spf13/cobra v1.5.0
go: downloading github.com/spf13/cast v1.5.1
go: downloading gorm.io/gorm v1.25.5
go: downloading github.com/go-playground/validator/v10 v10.20.0
go: downloading github.com/go-sql-driver/mysql v1.7.1
go: downloading github.com/viant/afs v1.16.0
go: downloading gorm.io/driver/mysql v1.5.1
go: downloading gorm.io/driver/postgres v1.5.2
go: downloading cloud.google.com/go/storage v1.52.0
go: downloading google.golang.org/api v0.230.0
go: downloading cloud.google.com/go v0.121.0
go: downloading github.com/coreos/go-oidc/v3 v3.9.0
go: downloading github.com/gin-gonic/gin v1.9.1
go: downloading github.com/magiconair/properties v1.8.5
go: downloading github.com/golang-jwt/jwt/v5 v5.2.2
go: downloading golang.org/x/oauth2 v0.30.0
go: downloading github.com/merico-ai/graphql v0.0.0-20260206020408-b7fd267bcfac
go: downloading github.com/mitchellh/mapstructure v1.5.0
go: downloading github.com/panjf2000/ants/v2 v2.4.6
go: downloading golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0
go: downloading golang.org/x/sync v0.16.0
go: downloading github.com/rogpeppe/go-internal v1.13.1
go: downloading gorm.io/datatypes v1.0.1
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/tidwall/gjson v1.14.3
go: downloading golang.org/x/sys v0.35.0
go: downloading github.com/fsnotify/fsnotify v1.4.9
go: downloading github.com/hashicorp/hcl v1.0.0
go: downloading github.com/pelletier/go-toml v1.9.3
go: downloading github.com/spf13/afero v1.10.0
go: downloading github.com/spf13/jwalterweatherman v1.1.0
go: downloading github.com/spf13/pflag v1.0.5
go: downloading github.com/subosito/gotenv v1.2.0
go: downloading gopkg.in/ini.v1 v1.67.0
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/chainguard-dev/git-urls v1.0.2
go: downloading github.com/inconshreveable/mousetrap v1.0.0
go: downloading github.com/libgit2/git2go/v33 v33.0.6
go: downloading github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b
go: downloading github.com/cockroachdb/redact v1.1.5
go: downloading github.com/getsentry/sentry-go v0.18.0
go: downloading github.com/go-git/go-git/v5 v5.12.0
go: downloading github.com/jinzhu/now v1.1.5
go: downloading github.com/go-playground/universal-translator v0.18.1
go: downloading github.com/gabriel-vasile/mimetype v1.4.7
go: downloading github.com/leodido/go-urn v1.4.0
go: downloading golang.org/x/crypto v0.41.0
go: downloading golang.org/x/text v0.28.0
go: downloading github.com/jackc/pgx/v5 v5.6.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading golang.org/x/mod v0.27.0
go: downloading github.com/jinzhu/inflection v1.0.0
go: downloading cloud.google.com/go/compute/metadata v0.7.0
go: downloading cloud.google.com/go/iam v1.5.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/googleapis/gax-go/v2 v2.14.1
go: downloading go.opentelemetry.io/contrib/detectors/gcp v1.36.0
go: downloading go.opentelemetry.io/otel v1.37.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.37.0
go: downloading go.opentelemetry.io/otel/sdk v1.37.0
go: downloading go.opentelemetry.io/otel/trace v1.37.0
go: downloading google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb
go: downloading google.golang.org/grpc v1.76.0
go: downloading google.golang.org/protobuf v1.36.10
go: downloading cloud.google.com/go/auth v0.16.0
go: downloading github.com/go-jose/go-jose/v3 v3.0.1
go: downloading github.com/gin-contrib/sse v0.1.0
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading golang.org/x/net v0.43.0
go: downloading github.com/snowflakedb/gosnowflake v1.19.1
go: downloading github.com/gocarina/gocsv v0.0.0-20220707092902-b9da1f06c77e
go: downloading golang.org/x/tools v0.36.0
go: downloading github.com/aws/aws-sdk-go v1.55.6
go: downloading github.com/lib/pq v1.10.2
go: downloading github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20260708090559-a0c568e41e08
go: downloading github.com/gin-contrib/cors v1.7.2
go: downloading github.com/swaggo/files v1.0.1
go: downloading github.com/swaggo/gin-swagger v1.6.0
go: downloading github.com/swaggo/swag v1.16.1
go: downloading github.com/robfig/cron/v3 v3.0.0
go: downloading github.com/tidwall/match v1.1.1
go: downloading github.com/tidwall/pretty v1.2.0
go: downloading github.com/gogo/protobuf v1.3.2
go: downloading github.com/kr/pretty v0.3.1
go: downloading dario.cat/mergo v1.0.0
go: downloading github.com/ProtonMail/go-crypto v1.0.0
go: downloading github.com/go-git/go-billy/v5 v5.5.0
go: downloading github.com/emirpasic/gods v1.18.1
go: downloading github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
go: downloading github.com/go-playground/locales v0.14.1
go: downloading github.com/jackc/pgpassfile v1.0.0
go: downloading github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a
go: downloading github.com/go-errors/errors v1.4.2
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b
go: downloading cloud.google.com/go/monitoring v1.24.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0
go: downloading github.com/go-logr/logr v1.4.3
go: downloading go.opentelemetry.io/otel/metric v1.37.0
go: downloading cloud.google.com/go/auth/oauth2adapt v0.2.8
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0
go: downloading github.com/google/s2a-go v0.1.9
go: downloading github.com/pelletier/go-toml/v2 v2.2.1
go: downloading github.com/ugorji/go/codec v1.2.12
go: downloading github.com/bytedance/sonic v1.11.6
go: downloading github.com/goccy/go-json v0.10.5
go: downloading github.com/json-iterator/go v1.1.12
go: downloading github.com/99designs/keyring v1.2.2
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0
go: downloading github.com/BurntSushi/toml v1.4.0
go: downloading github.com/apache/arrow-go/v18 v18.4.0
go: downloading github.com/aws/aws-sdk-go-v2 v1.38.1
go: downloading github.com/aws/aws-sdk-go-v2/config v1.27.11
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.17.11
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1
go: downloading github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15
go: downloading github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.28.6
go: downloading github.com/aws/smithy-go v1.22.5
go: downloading github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8
go: downloading github.com/KyleBanks/depth v1.2.1
go: downloading github.com/go-openapi/spec v0.20.4
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/pjbgf/sha1cd v0.3.0
go: downloading github.com/cyphar/filepath-securejoin v0.2.4
go: downloading github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
go: downloading github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
go: downloading github.com/jackc/puddle/v2 v2.2.1
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0
go: downloading golang.org/x/time v0.11.0
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.1.0
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.6
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.32.4
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.2
go: downloading github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4
go: downloading github.com/danieljoos/wincred v1.2.2
go: downloading github.com/dvsekhvalnov/jose2go v1.7.0
go: downloading github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2
go: downloading github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c
go: downloading github.com/mtibben/percent v0.2.1
go: downloading golang.org/x/term v0.34.0
go: downloading golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
go: downloading github.com/google/flatbuffers v25.2.10+incompatible
go: downloading github.com/klauspost/compress v1.18.0
go: downloading github.com/pierrec/lz4/v4 v4.1.22
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.20.5
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7
go: downloading github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2
go: downloading github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5
go: downloading github.com/jmespath/go-jmespath v0.4.0
go: downloading github.com/go-openapi/jsonpointer v0.19.5
go: downloading github.com/go-openapi/jsonreference v0.19.6
go: downloading github.com/go-openapi/swag v0.19.15
go: downloading github.com/cloudflare/circl v1.3.7
go: downloading gopkg.in/warnings.v0 v0.1.2
go: downloading github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
go: downloading github.com/kevinburke/ssh_config v1.2.0
go: downloading github.com/skeema/knownhosts v1.2.2
go: downloading github.com/xanzy/ssh-agent v0.3.3
go: downloading github.com/spiffe/go-spiffe/v2 v2.5.0
go: downloading github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
go: downloading github.com/envoyproxy/protoc-gen-validate v1.3.0
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2
go: downloading github.com/cloudwego/base64x v0.1.4
go: downloading golang.org/x/arch v0.7.0
go: downloading github.com/zeebo/xxh3 v1.0.2
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5
go: downloading github.com/PuerkitoBio/purell v1.1.1
go: downloading github.com/mailru/easyjson v0.7.7
go: downloading github.com/Microsoft/go-winio v0.6.2
go: downloading github.com/go-jose/go-jose/v4 v4.1.2
go: downloading github.com/zeebo/errs v1.4.0
go: downloading cel.dev/expr v0.25.1
go: downloading github.com/bytedance/sonic/loader v0.1.1
go: downloading github.com/klauspost/cpuid/v2 v2.2.11
go: downloading github.com/twitchyliquid64/golang-asm v0.15.1
go: downloading github.com/apache/thrift v0.22.0
go: downloading github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578
go: downloading github.com/josharian/intern v1.0.0
go: downloading github.com/klauspost/asmfmt v1.3.2
go: downloading github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8
go: downloading github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3
go: downloading github.com/cloudwego/iasm v0.2.0
go: downloading github.com/andybalholm/brotli v1.2.0
go: downloading github.com/golang/snappy v1.0.0
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/context: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/context
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/dal: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/dal
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/log: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/log
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/plugin: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/plugin
go: github.com/apache/incubator-devlake/helpers/pluginhelper/api tested by
	github.com/apache/incubator-devlake/helpers/pluginhelper/api.test imports
	github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api: cannot find module providing package github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api
go: module github.com/aws/aws-sdk-go is deprecated: aws-sdk-go is deprecated. Use aws-sdk-go-v2.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:25 PM UTC · Completed 8:29 PM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-review]

Looks good to me

Previous run

Review — comment

PR: #134 — chore(deps): update github.com/cncf/xds/go digest to dba9d58
Author: red-hat-konflux[bot] (MintMaker / Renovate)
Scope: 1 file changed (backend/go.mod), 1 indirect dependency digest bump

Summary

This is an automated dependency update PR that bumps the indirect dependency github.com/cncf/xds/go from pseudo-version 20250326154945-ae57f3c0d45f to 20260202195803-dba9d589def2 in backend/go.mod. The cncf/xds package provides CNCF xDS API definitions (used transitively via gRPC), and this is a routine digest update.

Findings

⚠ Missing go.sum update — medium / correctness

backend/go.mod references the new digest (dba9d589def2) but backend/go.sum still only contains checksum entries for the old digest (ae57f3c0d45f). The Go toolchain will look up the new version's checksum in go.sum at build time — when it is not found, the build will fail unless GONOSUMCHECK or -mod=mod is configured (neither is set in backend/Dockerfile.konflux).

This same pattern appears in other open MintMaker PRs for this repository (#121, #111), all of which update go.mod without a corresponding go.sum update and remain unmerged.

Remediation: Run cd backend && go mod tidy (or go mod download) to regenerate go.sum with the correct checksums for the new dependency version, and commit the updated go.sum alongside go.mod.

Verdict

One medium-severity correctness finding. The dependency itself (cncf/xds) is a well-known CNCF project with no supply chain concerns. The change is appropriately scoped — a single indirect dependency digest bump. No security, documentation, cross-repo, or style issues identified.

The missing go.sum update will likely cause the container build to fail, but does not pose a risk if addressed before merge.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:52 PM UTC · Completed 4:59 PM UTC
Commit: 701e62a · View workflow run →