chore: bump dependencies#284
Conversation
smira
force-pushed
the
chore/bump-deps-04-28
branch
from
6021718 to
1dd273e
Compare
There was a problem hiding this comment.
Pull request overview
This PR updates dependency and tooling pins (primarily Go modules and CI/build tooling) to address Dependabot alerts, and re-generates the repo’s generated build/config artifacts.
Changes:
- Bump Go module dependencies in
go.modand refreshgo.sum. - Update build toolchain versions in the generated
Makefile/Dockerfile, including switching the vuln scan stage todis-vulncheck. - Bump pinned GitHub Actions revisions and refresh generated CI/config files.
Reviewed changes
Copilot reviewed 10 out of 11 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| go.mod | Bumps several direct/indirect Go module versions. |
| go.sum | Adds checksum entries corresponding to module version bumps. |
| Makefile | Updates tool version pins; adds CI helper targets (ci-temp-release-tag, check-dirty) and a local renovate runner. |
| Dockerfile | Updates base/tool images and installs/runs dis-vulncheck for vuln scanning. |
| .golangci.yml | Regenerated config; adds explicit build-tags field. |
| .github/workflows/ci.yaml | Updates action pins; adds steps to set temp release tag and enforce clean tree after generation. |
| .github/workflows/stale.yml | Bumps actions/stale pin. |
| .github/workflows/slack-notify.yaml | Bumps slackapi/slack-github-action pin. |
| .github/workflows/slack-notify-ci-failure.yaml | Bumps slackapi/slack-github-action pin. |
| .dockerignore | Adjusts generated header and whitelists .disvulncheck.yaml into Docker build context. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| !README.md | ||
| !.markdownlint.json | ||
| !hack/govulncheck.sh | ||
| !.disvulncheck.yaml |
There was a problem hiding this comment.
.dockerignore whitelists .disvulncheck.yaml, but that file doesn’t appear to exist in the repo. If dis-vulncheck is expected to use a repo config file, it should be added to the PR (and/or referenced explicitly); otherwise this exception should be removed to avoid confusion about what’s included in the Docker build context.
| !.disvulncheck.yaml |
Rekres & bump, some minor deps to address Dependabot alerts. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
smira
force-pushed
the
chore/bump-deps-04-28
branch
from
1dd273e to
de4d5cb
Compare
|
/m |
Rekres & bump, some minor deps to address Dependabot alerts.