chore: Dependency Upgrades#51
Merged
Merged
Conversation
SafeDep Report Summary
⚠ 1 packages are identified as suspicious, human review is recommended. Package Details
This report is generated by SafeDep Github App |
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR updates project dependencies and tooling to their latest versions. The changes include upgrading the Go version from 1.25.1 to 1.25.2 and updating numerous direct and indirect dependencies to more recent releases.
Key Changes:
- Go version upgraded from 1.25.1 to 1.25.2
- Direct dependencies updated (e.g., cyclonedx-go, go-pretty, posthog-go, golang.org/x/net)
- Indirect dependencies updated across Google Cloud, OpenTelemetry, Prometheus, and other packages
Reviewed Changes
Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| go.mod | Updates Go version and all direct/indirect dependency versions |
| .tool-versions | Updates golang toolchain version to match go.mod |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #51 +/- ##
=======================================
Coverage 20.01% 20.01%
=======================================
Files 22 22
Lines 1239 1239
=======================================
Hits 248 248
Misses 972 972
Partials 19 19 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
vet Summary ReportThis report is generated by vet Policy Checks
Malicious Package AnalysisMalicious package analysis was performed using SafeDep Cloud API Malicious Package Analysis Report
Changed PackagesChanged Packages
Policy ViolationsPackages Violating Policy[Go]
|
chore: Go dependency upgrades chore: Tidy dependencies fix: Dockerfile
abhisek
force-pushed
the
chore/dependency-upgrades
branch
from
9c402ed to
66d078e
Compare
KunalSin9h
approved these changes
Oct 28, 2025
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| @@ -1,4 +1,4 @@ | |||
| FROM --platform=$BUILDPLATFORM golang:1.25-bookworm@sha256:c4bc0741e3c79c0e2d47ca2505a06f5f2a44682ada94e1dba251a3854e60c2bd AS build | |||
| FROM --platform=$BUILDPLATFORM golang:1.25-trixie@sha256:7534a6264850325fcce93e47b87a0e3fddd96b308440245e6ab1325fa8a44c91 as build | |||
There was a problem hiding this comment.
🔴 glibc version mismatch between build and runtime Docker stages causes binary incompatibility
The Dockerfile change introduces a glibc version mismatch that will cause the built binary to fail at runtime.
The change:
- Build stage changed from
golang:1.25-bookworm(Debian 12, glibc 2.36) togolang:1.25-trixie(Debian 13, glibc 2.38+) - Runtime stage remains
debian:11-slim(Debian 11/Bullseye, glibc 2.31)
Why this is a problem:
The build uses CGO_ENABLED=1 (Dockerfile:18), which means the binary is dynamically linked against glibc. When a CGO-enabled binary is compiled against a newer glibc (2.38+ in Trixie), it may use symbols that don't exist in older glibc versions (2.31 in Bullseye).
Expected behavior: Container runs successfully
Actual behavior: Container will fail at startup with errors like:
/usr/local/bin/xbom: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.XX' not found
Impact: The Docker image will be completely broken - the xbom binary will not execute at all in the runtime container.
Recommendation: Either update the runtime stage to use a compatible Debian version (e.g., debian:13-slim or debian:trixie-slim), or revert the build stage back to golang:1.25-bookworm to maintain compatibility with debian:11-slim.
Was this helpful? React with 👍 or 👎 to provide feedback.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.