fix(deps): update go minor dependencies by red-hat-konflux[bot] · Pull Request #682 · konflux-ci/build-service

red-hat-konflux · 2026-07-24T10:00:47Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/Masterminds/semver/v3	`v3.4.0` → `v3.5.0`
github.com/ProtonMail/go-crypto	`v1.3.0` → `v1.4.1`
github.com/avast/retry-go/v4	`v4.3.3` → `v4.7.0`
github.com/bmatcuk/doublestar/v4	`v4.7.1` → `v4.10.0`
github.com/bradleyfalzon/ghinstallation/v2	`v2.17.0` → `v2.19.0`
github.com/containerd/typeurl/v2	`v2.2.2` → `v2.3.0`
github.com/cyphar/filepath-securejoin	`v0.6.1` → `v0.7.0`
github.com/devfile/library/v2	`v2.2.1-0.20230418160146-e75481b7eebd` → `v2.4.0`
github.com/docker/cli	`v29.2.1+incompatible` → `v29.7.2+incompatible`
github.com/fatih/color	`v1.18.0` → `v1.19.0`
github.com/felixge/httpsnoop	`v1.0.4` → `v1.1.0`
github.com/fsnotify/fsnotify	`v1.9.0` → `v1.10.1`
github.com/go-git/go-billy/v5	`v5.7.0` → `v5.9.1`
github.com/go-git/go-git/v5	`v5.16.5` → `v5.19.2`
github.com/go-openapi/jsonpointer	`v0.22.4` → `v0.24.0`
github.com/go-openapi/jsonpointer	`v0.22.5` → `v0.24.0`
github.com/go-openapi/strfmt	`v0.25.0` → `v0.27.0`
github.com/go-openapi/swag	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/cmdutils	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/cmdutils	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/conv	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/conv	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/fileutils	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/fileutils	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/jsonname	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/jsonname	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/jsonutils	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/jsonutils	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/loading	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/loading	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/mangling	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/mangling	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/netutils	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/netutils	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/stringutils	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/stringutils	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/typeutils	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/typeutils	`v0.25.5` → `v0.28.0`
github.com/go-openapi/swag/yamlutils	`v0.25.4` → `v0.28.0`
github.com/go-openapi/swag/yamlutils	`v0.25.5` → `v0.28.0`
github.com/go-viper/mapstructure/v2	`v2.4.0` → `v2.5.0`
github.com/gofri/go-github-ratelimit	`v1.0.3-0.20230428184158-a500e14de53f` → `v1.1.1`
github.com/google/cel-go	`v0.27.0` → `v0.31.0`
github.com/grpc-ecosystem/grpc-gateway/v2	`v2.28.0` → `v2.30.0`
github.com/grpc-ecosystem/grpc-gateway/v2	`v2.27.6` → `v2.30.0`
github.com/hashicorp/go-version	`v1.8.0` → `v1.9.0`
github.com/kevinburke/ssh_config	`v1.4.0` → `v1.6.0`
github.com/klauspost/compress	`v1.18.4` → `v1.19.2`
github.com/klauspost/cpuid/v2	`v2.3.0` → `v2.4.0`
github.com/magefile/mage	`v1.14.0` → `v1.17.2`
github.com/moby/buildkit	`v0.12.5` → `v0.32.2`
github.com/onsi/ginkgo/v2	`v2.27.2` → `v2.32.0`
github.com/onsi/ginkgo/v2	`v2.28.0` → `v2.32.0`
github.com/onsi/gomega	`v1.38.2` → `v1.42.1`
github.com/onsi/gomega	`v1.39.1` → `v1.42.1`
github.com/openshift-pipelines/pipelines-as-code	`v0.43.0` → `v0.50.0`
github.com/openshift-pipelines/pipelines-as-code	`v0.34.0` → `v0.50.0`
github.com/operator-framework/operator-lib	`v0.16.0` → `v0.19.0`
github.com/pjbgf/sha1cd	`v0.5.0` → `v0.6.0`
github.com/prometheus/client_golang	`v1.23.2` → `v1.24.1`
github.com/prometheus/common	`v0.67.5` → `v0.70.1`
github.com/prometheus/procfs	`v0.19.2` → `v0.21.1`
github.com/prometheus/statsd_exporter	`v0.28.0` → `v0.30.0`
github.com/tektoncd/cli	`v0.44.1` → `v0.46.0`
github.com/tektoncd/pipeline	`v1.10.2` → `v1.15.0`
github.com/tektoncd/pipeline	`v1.9.2` → `v1.15.0`
github.com/vmware-tanzu/velero	`v1.17.2` → `v1.18.2`
github.com/xanzy/go-gitlab	`v0.108.0` → `v0.115.0`
github.com/xanzy/go-gitlab	`v0.114.0` → `v0.115.0`
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	`v0.64.0` → `v0.70.0`
go.opentelemetry.io/otel	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/exporters/prometheus	`v0.63.0` → `v0.67.0`
go.opentelemetry.io/otel/exporters/stdout/stdouttrace	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/metric	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/sdk	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/sdk/metric	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/otel/trace	`v1.41.0` → `v1.45.0`
go.opentelemetry.io/proto/otlp	`v1.9.0` → `v1.11.0`
go.uber.org/zap	`v1.27.1` → `v1.28.0`
golang.org/x/crypto	`v0.48.0` → `v0.54.0`
golang.org/x/crypto	`v0.49.0` → `v0.54.0`
golang.org/x/mod	`v0.33.0` → `v0.38.0`
golang.org/x/mod	`v0.34.0` → `v0.38.0`
golang.org/x/net	`v0.51.0` → `v0.57.0`
golang.org/x/net	`v0.52.0` → `v0.57.0`
golang.org/x/oauth2	`v0.35.0` → `v0.36.0`
golang.org/x/sync	`v0.19.0` → `v0.22.0`
golang.org/x/sync	`v0.20.0` → `v0.22.0`
golang.org/x/sys	`v0.41.0` → `v0.47.0`
golang.org/x/sys	`v0.42.0` → `v0.47.0`
golang.org/x/term	`v0.40.0` → `v0.45.0`
golang.org/x/term	`v0.41.0` → `v0.45.0`
golang.org/x/text	`v0.34.0` → `v0.40.0`
golang.org/x/text	`v0.35.0` → `v0.40.0`
golang.org/x/time	`v0.14.0` → `v0.15.0`
golang.org/x/tools	`v0.42.0` → `v0.48.0`
golang.org/x/tools	`v0.43.0` → `v0.48.0`
google.golang.org/api	`v0.262.0` → `v0.292.0`
google.golang.org/grpc	`v1.79.1` → `v1.83.0`
google.golang.org/grpc	`v1.79.3` → `v1.83.0`
k8s.io/api	`v0.35.0` → `v0.36.3`
k8s.io/api	`v0.34.2` → `v0.36.3`
k8s.io/api	`v0.35.2` → `v0.36.3`
k8s.io/apiextensions-apiserver	`v0.35.0` → `v0.36.3`
k8s.io/apiextensions-apiserver	`v0.35.2` → `v0.36.3`
k8s.io/apiextensions-apiserver	`v0.34.2` → `v0.36.3`
k8s.io/apimachinery	`v0.35.0` → `v0.36.3`
k8s.io/apimachinery	`v0.34.2` → `v0.36.3`
k8s.io/apimachinery	`v0.35.2` → `v0.36.3`
k8s.io/apiserver	`v0.35.0` → `v0.36.3`
k8s.io/apiserver	`v0.34.2` → `v0.36.3`
k8s.io/client-go	`v0.35.0` → `v0.36.3`
k8s.io/client-go	`v0.34.2` → `v0.36.3`
k8s.io/component-base	`v0.35.0` → `v0.36.3`
k8s.io/component-base	`v0.34.2` → `v0.36.3`
k8s.io/klog/v2	`v2.130.1` → `v2.140.0`
oras.land/oras-go/v2	`v2.5.0` → `v2.6.2`
sigs.k8s.io/apiserver-network-proxy/konnectivity-client	`v0.31.2` → `v0.36.0`
sigs.k8s.io/controller-runtime	`v0.23.3` → `v0.24.1`
sigs.k8s.io/controller-runtime	`v0.22.4` → `v0.24.1`
sigs.k8s.io/controller-runtime	`v0.20.2` → `v0.24.1`
sigs.k8s.io/structured-merge-diff/v6	`v6.3.2-0.20260122202528-d9cc6641c482` → `v6.4.2`
sigs.k8s.io/structured-merge-diff/v6	`v6.3.2` → `v6.4.2`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

Masterminds/semver (github.com/Masterminds/semver/v3)

`v3.5.0`

Compare Source

What's Changed

Adding more prerelease tests by @mattfarina in #273
Update constraint error messages by @mattfarina in #278
Fix edge cases by @mattfarina in #279
Adding some checks in by @mattfarina in #280
Updating deps by @mattfarina in #281
Bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #282
Bump actions/cache from 4.2.3 to 5.0.5 by @dependabot[bot] in #283
Bump golangci/golangci-lint-action from 7.0.1 to 9.2.0 by @dependabot[bot] in #284
Updating gitignore for devcontainers by @mattfarina in #286
Fixing some quality issues by @mattfarina in #287

New Contributors

@dependabot[bot] made their first contribution in #282

Full Changelog: Masterminds/semver@v3.4.0...v3.5.0

ProtonMail/go-crypto (github.com/ProtonMail/go-crypto)

`v1.4.1`

Compare Source

What's Changed

Properly handle ECC keys with invalid points in #304

Full Changelog: ProtonMail/go-crypto@v1.4.0...v1.4.1

`v1.4.0`

Compare Source

What's Changed

Ignore leading and trailing whitespaces in the armor body in #288
Update key_generation.go, rename variables to avoid shadowing in #290
Add InsecureGenerateNonCriticalKeyFlags option to generate non-critical key flags signature subpackets in #291
Add InsecureGenerateNonCriticalSignatureCreationTime option to generate non-critical signature creation time subpackets in #292
Bump dependencies and min go version to 1.23 in #294
ECDHv4: Error on low-order x25519 public key curve points in #299
Cleartext: Only allow valid hashes in header in #298

Full Changelog: ProtonMail/go-crypto@v1.3.0...v1.4.0

avast/retry-go (github.com/avast/retry-go/v4)

`v4.7.0`

Compare Source

What's Changed

support context cancel cause by @NivKeidan in #117
Bump github.com/stretchr/testify from 1.10.0 to 1.11.1 by @dependabot[bot] in #136
Add FullJitterBackoffDelay by @amirrezafahimi in #128
No delay after final retry on max attempts by @StounhandJ in #129
BackOffDelay multiplies attempts from zero by @StounhandJ in #130
add Go version 1.25 to test matrix for expanded compatibility testing by @JaSei in #142

New Contributors

@NivKeidan made their first contribution in #117
@amirrezafahimi made their first contribution in #128
@StounhandJ made their first contribution in #129

Full Changelog: avast/retry-go@4.6.1...v4.7.0

`v4.6.1`

Compare Source

What's Changed

Update link to docs by @ajeetdsouza in #100
fix test for slow windows + add newer golang versions by @JaSei in #126
Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #123
Make sure DelayType function gets consistent values of n by @haaawk in #125

New Contributors

@ajeetdsouza made their first contribution in #100
@haaawk made their first contribution in #125

Full Changelog: avast/retry-go@4.6.0...v4.6.1

`v4.6.0`

Compare Source

What's Changed

Introduce UntilSucceeded option to improve readability by @natenho in #116
Fix the inconsistency in the number of times passed in onRetry by @FarmerChillax in #114
Bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @dependabot in #112

New Contributors

@natenho made their first contribution in #116
@FarmerChillax made their first contribution in #114

Full Changelog: avast/retry-go@v4.5.1...v4.6.0

`v4.5.1`

Compare Source

What's Changed

Bump github.com/stretchr/testify from 1.8.2 to 1.8.4 by @dependabot in #95
add missing comma in the example by @spacewander in #101
Add an example which shows err history by @avinassh in #98
fix potential panic in IsRecoverable by @jalaziz in #104

New Contributors

[@spacewander](h

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

red-hat-konflux · 2026-07-24T10:00:49Z

ℹ️ Artifact update notice

File name: e2e-tests/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

18 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.6` -> `1.26.5`
`github.com/google/go-containerregistry`	`v0.21.0` -> `v0.21.8`
`cel.dev/expr`	`v0.25.1` -> `v0.25.2`
`github.com/42wim/httpsig`	`v1.2.3` -> `v1.2.4`
`github.com/Microsoft/go-winio`	`v0.6.2` -> `v0.6.3-0.20251027160822-ad3df93bed29`
`github.com/docker/docker-credential-helpers`	`v0.9.3` -> `v0.9.8`
`github.com/fxamacker/cbor/v2`	`v2.9.0` -> `v2.9.2`
`github.com/go-logr/logr`	`v1.4.3` -> `v1.4.4`
`github.com/go-openapi/jsonreference`	`v0.21.5` -> `v1.0.0`
`github.com/mattn/go-colorable`	`v0.1.14` -> `v0.1.15`
`github.com/mattn/go-isatty`	`v0.0.20` -> `v0.0.24`
`go.yaml.in/yaml/v3`	`v3.0.4` -> `v3.0.5`
`golang.org/x/exp`	`v0.0.0-20260312153236-7ab1446f8b90` -> `v0.0.0-20260727155853-b88d891fe743`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260406210006-6f92a3bedf2d` -> `v0.0.0-20260803160001-6ac0973c030d`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260401024825-9d38bb4040a9` -> `v0.0.0-20260803160001-6ac0973c030d`
`google.golang.org/protobuf`	`v1.36.11` -> `v1.36.12-0.20260120151049-f2248ac996af`
`k8s.io/kube-openapi`	`v0.0.0-20260330154417-16be699c7b31` -> `v0.0.0-20260721132016-d427ff9ee9ad`
`k8s.io/utils`	`v0.0.0-20251002143259-bc988d571ff4` -> `v0.0.0-20260707023825-cf1189d6abe3`
`knative.dev/pkg`	`v0.0.0-20250424013628-d5e74d29daa3` -> `v0.0.0-20260727151759-521cb33b33dd`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

19 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.6` -> `1.26.5`
`github.com/go-logr/logr`	`v1.4.3` -> `v1.4.4`
`github.com/google/go-containerregistry`	`v0.21.1` -> `v0.21.7`
`knative.dev/pkg`	`v0.0.0-20260120122510-4a022ed9999a` -> `v0.0.0-20260727151759-521cb33b33dd`
`cel.dev/expr`	`v0.25.1` -> `v0.25.2`
`github.com/42wim/httpsig`	`v1.2.3` -> `v1.2.4`
`github.com/docker/docker-credential-helpers`	`v0.9.3` -> `v0.9.5`
`github.com/fxamacker/cbor/v2`	`v2.9.0` -> `v2.9.2`
`github.com/go-openapi/errors`	`v0.22.6` -> `v0.22.8`
`github.com/go-openapi/jsonreference`	`v0.21.4` -> `v1.0.0`
`github.com/google/pprof`	`v0.0.0-20250403155104-27863c87afa6` -> `v0.0.0-20260402051712-545e8a4df936`
`github.com/sirupsen/logrus`	`v1.9.3` -> `v1.9.4`
`go.yaml.in/yaml/v2`	`v2.4.3` -> `v2.4.4`
`go.yaml.in/yaml/v3`	`v3.0.4` -> `v3.0.5`
`golang.org/x/exp`	`v0.0.0-20260112195511-716be5621a96` -> `v0.0.0-20260727155853-b88d891fe743`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260209200024-4cfbd4190f57` -> `v0.0.0-20260803160001-6ac0973c030d`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260209200024-4cfbd4190f57` -> `v0.0.0-20260803160001-6ac0973c030d`
`google.golang.org/protobuf`	`v1.36.11` -> `v1.36.12-0.20260120151049-f2248ac996af`
`k8s.io/kube-openapi`	`v0.0.0-20251125145642-4e65d59e963e` -> `v0.0.0-20260721132016-d427ff9ee9ad`
`k8s.io/utils`	`v0.0.0-20260108192941-914a6e750570` -> `v0.0.0-20260707023825-cf1189d6abe3`

fullsend-ai-review · 2026-07-24T10:02:07Z

🤖 Finished Review · ✅ Success · Started 10:02 AM UTC · Completed 10:10 AM UTC
Commit: 37b10e4 · View workflow run →

fullsend-ai-review · 2026-07-24T10:10:32Z

Looks good to me

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Looks good to me

Previous run (4)

Review

Findings

Low

[api-contract] go.mod — Major version bumps across several key dependencies (tektoncd/pipeline v1.10→v1.15, pipelines-as-code v0.43→v0.50, controller-runtime v0.23→v0.24, k8s.io v0.35→v0.36, go-gitlab v0.108→v0.115) cross minor version boundaries and may carry API changes. The absence of any .go source file changes suggests compatibility is maintained. Verify CI results confirm no API breakage.

Previous run (5)

Looks good to me

Labels: Renovate dependency update PR modifying go.mod and go.sum files

Previous run (6)

Looks good to me

Previous run (7)

Review

Findings

High

[API contract violation] go.mod:36 — github.com/tektoncd/pipeline jumps from v1.10.2 to v1.15.0 (5 minor versions) and github.com/openshift-pipelines/pipelines-as-code jumps from v0.43.0 to v0.50.0 (7 minor versions). CI is actively failing: both the Lint (golangci-lint) and Envtest (integration tests) jobs fail on this PR. This confirms that the large dependency jumps have introduced breaking changes that require corresponding source code modifications, which are absent from this PR.
Remediation: The PR cannot be merged in its current state. Source code changes are required to adapt to API changes in the bumped dependencies. The PR author (Renovate bot) or a maintainer must investigate the Lint and Envtest failures, identify the breaking API changes, and add the necessary .go file modifications to this PR.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (8)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89-90 — The go.mod contains an explicit comment: "If you update dependencies below you must also update internal/controller/suite_test.go". This PR bumps tektoncd/pipeline from v1.10.2 to v1.15.0 and pipelines-as-code from v0.43.0 to v0.50.0 in go.mod, but internal/controller/suite_test.go still hardcodes the old versions in the CRD directory paths on lines 89 and 90. After go mod download pulls the new versions, the envtest suite will look for CRDs in directories that no longer exist in the module cache, causing integration tests (make test) to fail.
Remediation: Update internal/controller/suite_test.go: change pipeline@v1.10.2 to pipeline@v1.15.0 (line 89) and pipelines-as-code@v0.43.0 to pipelines-as-code@v0.50.0 (line 90).

Low

[version-skew] e2e-tests/go.mod:24 — In the e2e-tests replace block, k8s.io/apiserver remains pinned at v0.34.2 while all other k8s.io modules (api, apiextensions-apiserver, apimachinery, client-go, component-base) were bumped to v0.36.3. This two-minor-version skew may cause compilation or runtime issues if newer k8s packages depend on apiserver types that changed between v0.34 and v0.36. Verify whether this pin is intentional; if not, bump to k8s.io/apiserver v0.36.3 to match the other k8s.io modules.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (9)

Review

Findings

Medium

[API contract / breaking change risk] go.mod:35 — The openshift-pipelines/pipelines-as-code dependency jumps from v0.43.0 to v0.50.0 and tektoncd/pipeline from v1.10.2 to v1.15.0. These are significant minor version bumps that may introduce breaking API changes in types, constants, or interfaces consumed by this operator. The e2e-tests/go.mod similarly jumps tektoncd/pipeline from v1.9.2 to v1.15.0. Without corresponding production code changes in this PR, this relies entirely on compile and test success to catch incompatibilities.
Remediation: Confirm that CI (unit tests, integration tests, and linter) passes cleanly on this PR branch. If CI is green with no production code changes needed, the upgrades are safe.

Low

[version consistency] e2e-tests/go.mod:27 — The e2e-tests/go.mod pins sigs.k8s.io/controller-runtime to v0.20.2 via a replace directive, while the main go.mod uses v0.23.3. This version skew between modules pre-dates this PR but the k8s.io bump widens the gap.

Previous run (10)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The go.mod comment // If you update dependencies below you must also update internal/controller/suite_test.go warns that suite_test.go must stay in sync. This PR bumps two dependencies in that group but does not update suite_test.go:
1. tektoncd/pipeline from v1.10.2 to v1.15.0, but line 89 still hardcodes pipeline@v1.10.2
2. openshift-pipelines/pipelines-as-code from v0.43.0 to v0.50.0, but line 90 still hardcodes pipelines-as-code@v0.43.0
These CRD directory paths reference old module versions in GOPATH/pkg/mod that will not exist after go mod download resolves the new versions. With ErrorIfCRDPathMissing: true (line 94), all envtest integration tests will fail.

Remediation: Update line 89 to reference pipeline@v1.15.0 and line 90 to reference pipelines-as-code@v0.50.0.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (11)

Looks good to me

Previous run (12)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The go.mod file explicitly warns: "If you update dependencies below you must also update internal/controller/suite_test.go." This PR bumps tektoncd/pipeline from v1.10.2 to v1.15.0 and pipelines-as-code from v0.43.0 to v0.50.0, but suite_test.go still hardcodes the old versions: line 89 references pipeline@v1.10.2 and line 90 references pipelines-as-code@v0.43.0 in CRD paths. The envtest setup constructs filesystem paths to find CRD YAML files in the Go module cache using these hardcoded versions. After this update, go mod download will fetch v1.15.0 and v0.50.0 — the old version directories won't exist in the module cache, causing integration tests (envtest) to fail with "CRD path not found" errors (ErrorIfCRDPathMissing: true is set at line 94).
Remediation: Update internal/controller/suite_test.go: change line 89 to reference pipeline@v1.15.0 and line 90 to reference pipelines-as-code@v0.50.0.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (13)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The go.mod comment on line 31 states: "If you update dependencies below you must also update internal/controller/suite_test.go." This PR bumps tektoncd/pipeline from v1.10.2 to v1.15.0 and pipelines-as-code from v0.43.0 to v0.50.0, but suite_test.go still hardcodes the old versions in CRDDirectoryPaths (line 89: pipeline@v1.10.2, line 90: pipelines-as-code@v0.43.0). The envtest environment loads CRDs from $GOPATH/pkg/mod/...@<version>/..., so these paths will resolve to the old (possibly absent) module directories. Integration tests will fail at startup because ErrorIfCRDPathMissing is true (line 94).
Remediation: Update line 89 to pipeline@v1.15.0 and line 90 to pipelines-as-code@v0.50.0 to match the new go.mod versions.

Medium

[api-contract] go.mod:23 — This PR introduces a version skew between k8s.io modules: k8s.io/apimachinery is bumped to v0.36.3 (along with apiextensions-apiserver, apiserver, and component-base) while k8s.io/api remains at v0.35.0 and k8s.io/client-go is pinned to v0.35.0 via replace directive. Additionally, sigs.k8s.io/controller-runtime is bumped to v0.24.1 which may expect k8s.io v0.36.x modules. The Kubernetes project recommends that k8s.io modules share the same minor version; this mismatch could cause type incompatibilities or runtime issues.
Remediation: Either bump k8s.io/api and k8s.io/client-go to v0.36.3 (updating the replace directive), or keep all k8s.io modules at v0.35.x.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (14)

Review

Findings

Medium

[stale-reference] internal/controller/suite_test.go:89 — The go.mod comment at line 30 states: "If you update dependencies below you must also update internal/controller/suite_test.go." This PR updates pipelines-as-code from v0.43.0 to v0.49.0 and tektoncd/pipeline from v1.10.2 to v1.15.0, but suite_test.go was not updated. Lines 89–90 hardcode these version strings in filepath.Join calls to locate CRD configurations in the Go module cache (e.g., pipeline@v1.10.2 and pipelines-as-code@v0.43.0). With ErrorIfCRDPathMissing: true (line 94), the envtest setup will fail when it cannot find CRD config directories at the old module paths.
Remediation: Update internal/controller/suite_test.go line 89 to pipeline@v1.15.0 and line 90 to pipelines-as-code@v0.49.0 to match the new dependency versions in go.mod.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (15)

Review

Findings

Low

[version inconsistency] e2e-tests/go.mod:3 — The main module uses Go 1.26.4 while the e2e-tests module uses Go 1.26.5. These are separate Go modules with independent dependency trees and can legitimately target different patch-level Go versions. Renovate independently resolves each module's go directive based on its own dependency constraints, so this is expected behavior for a bot-managed multi-module repo.
[API compatibility] go.mod:37 — Significant version jumps in several direct dependencies: tektoncd/pipeline v1.10.2 → v1.15.0 (5 minor versions), openshift-pipelines/pipelines-as-code v0.43.0 → v0.49.0 (6 minor versions), xanzy/go-gitlab v0.108.0 → v0.115.0 (7 minor versions), and k8s.io modules v0.35.0 → v0.36.3. While compilation succeeds under Renovate management, subtle runtime behavioral changes are possible with jumps of this magnitude.

Previous run (16)

Looks good to me

Previous run (17)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The go.mod comment on line 30 explicitly requires internal/controller/suite_test.go to be updated when the dependencies in the second require block change. This PR updates tektoncd/pipeline from v1.10.2 to v1.15.0 and pipelines-as-code from v0.43.0 to v0.49.0 in go.mod, but suite_test.go still hardcodes the old versions at lines 89–90 for CRD path resolution. With ErrorIfCRDPathMissing: true (line 94), the envtest Environment will fail to start because filepath.Join will produce paths to old version directories that no longer exist in the Go module cache. All integration tests (make test) will break.
Remediation: Update internal/controller/suite_test.go line 89 to pipeline@v1.15.0 and line 90 to pipelines-as-code@v0.49.0.

Low

[version-consistency] e2e-tests/go.mod:3 — The e2e-tests module declares go 1.26.5 while the main module declares go 1.26.4. These are separate modules so this is not an error, but different Go toolchain versions within the same repository can lead to subtle behavioral differences (e.g., different default GODEBUG settings).

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (18)

Review

Findings

Critical

[api-contract] go.mod:18 — k8s.io module version skew: k8s.io/apimachinery is bumped to v0.36.3 and sigs.k8s.io/controller-runtime to v0.24.1 (which requires k8s.io v0.36.x), but k8s.io/api remains at v0.35.0 and k8s.io/client-go is pinned to v0.35.0 via replace directive. The Kubernetes project requires all k8s.io staging modules to be at the same minor version. The indirect modules (apiextensions-apiserver, apiserver, component-base) are also bumped to v0.36.3 while api and client-go lag behind.
Remediation: Bump k8s.io/api to v0.36.3 and update the k8s.io/client-go replace directive from v0.35.0 to v0.36.3.

High

[test-integrity] internal/controller/suite_test.go:89 — Hardcoded CRD paths reference old dependency versions. The go.mod comment on line 30 explicitly warns: "If you update dependencies below you must also update internal/controller/suite_test.go." This PR bumps tektoncd/pipeline from v1.10.2 to v1.15.0 and pipelines-as-code from v0.43.0 to v0.49.0, but suite_test.go still hardcodes the old versions at lines 89–90. With ErrorIfCRDPathMissing: true, envtest setup will fail.
Remediation: Update suite_test.go line 89 to pipeline@v1.15.0 and line 90 to pipelines-as-code@v0.49.0.

Medium

[api-contract] e2e-tests/go.mod — The PR introduces k8s.io version skew in the e2e-tests module by bumping apimachinery, apiextensions-apiserver, apiserver, and component-base replace directives from v0.34.2 to v0.36.3, while leaving k8s.io/api and k8s.io/client-go pinned at v0.34.2. This creates a two-minor-version gap. The controller-runtime replace is also bumped from v0.20.2 to v0.24.1, which requires k8s.io v0.36.x.
Remediation: Bump k8s.io/api and k8s.io/client-go replace directives from v0.34.2 to v0.36.3.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (19)

Review

Findings

Medium

[api-contract] go.mod — This PR bumps several dependencies by multiple minor versions (tektoncd/pipeline v1.10.2→v1.15.0, pipelines-as-code v0.43.0→v0.49.0, go-gitlab v0.108.0→v0.115.0) with no corresponding Go source changes. While the absence of source changes most likely means the consumed APIs remain backward-compatible, CI should confirm that make test and make lint pass to validate no breakage.

Low

[version-consistency] e2e-tests/go.mod:3 — The main module uses go 1.26.4 while the e2e-tests module uses go 1.26.5. These are separate Go modules with independent dependency graphs, and the Go directive only specifies the minimum toolchain version. A one-patch-version difference has no functional impact.

Previous run (20)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The go.mod file has an explicit comment stating "If you update dependencies below you must also update internal/controller/suite_test.go". The PR bumps tektoncd/pipeline from v1.10.2 to v1.15.0 and pipelines-as-code from v0.43.0 to v0.49.0, but suite_test.go still hardcodes the old versions in CRDDirectoryPaths at lines 89–90. The envtest setup will fail to find CRD files because it will look for module directories named pipeline@v1.10.2 and pipelines-as-code@v0.43.0, which will no longer exist in the module cache after go mod download pulls the new versions.
Remediation: Update line 89 to use pipeline@v1.15.0 and line 90 to use pipelines-as-code@v0.49.0 in internal/controller/suite_test.go.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (21)

Review

Findings

High

[api-contract] go.mod — This PR bumps several major direct dependencies (controller-runtime v0.23→v0.24, tektoncd/pipeline v1.10→v1.14, pipelines-as-code v0.43→v0.49, go-gitlab v0.108→v0.115) without corresponding source code changes. CI confirms the incompatibility: both the Lint and Envtest checks have failed. Additionally, internal/controller/suite_test.go contains a hardcoded path reference to pipelines-as-code@v0.43.0 that must be updated to the new version. Note: the go-github v75→v88 change is only in the indirect dependency graph (source imports go-github/v45, unchanged).
Remediation: Source code changes are required to match the new API surfaces. At minimum: update the hardcoded pipelines-as-code version path in suite_test.go, and address all Lint and Envtest failures visible in CI. This PR should not be merged until CI passes.

Labels: PR updates Go dependencies via Renovate bot

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (22)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The go.mod comment on line 30 explicitly requires that internal/controller/suite_test.go be updated when the dependencies in that require block change. This PR updates tektoncd/pipeline from v1.10.2 to v1.14.0 and pipelines-as-code from v0.43.0 to v0.49.0 in go.mod, but suite_test.go still references the old versions in its CRD directory paths: pipeline@v1.10.2 (line 89) and pipelines-as-code@v0.43.0 (line 90). The envtest environment constructs filesystem paths to CRD YAML files using these version strings. After go mod tidy, the module cache will contain the new versions, and the old version directories may not exist, causing CRD loading to fail and all integration tests to break.
Remediation: Update line 89 to use pipeline@v1.14.0 and line 90 to use pipelines-as-code@v0.49.0 in internal/controller/suite_test.go to match the new versions in go.mod.

Labels: PR is a Renovate bot dependency version update

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (23)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89-90 — The go.mod file has an explicit comment on line 30 stating: "If you update dependencies below you must also update internal/controller/suite_test.go". This PR updates openshift-pipelines/pipelines-as-code from v0.43.0 to v0.49.0 and tektoncd/pipeline from v1.10.2 to v1.15.0, but internal/controller/suite_test.go hardcodes the old versions in filesystem paths on lines 89–90: pipeline@v1.10.2 and pipelines-as-code@v0.43.0. These paths will not exist after the dependency update, causing envtest setup to fail at runtime when it tries to load CRD configs from the module cache.
Remediation: Update internal/controller/suite_test.go line 89 to reference pipeline@v1.15.0 and line 90 to reference pipelines-as-code@v0.49.0, matching the new go.mod versions.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (24)

Review

Findings

Medium

[major version bumps] go.mod — This PR includes significant dependency version jumps: k8s.io libraries v0.35→v0.36.3, tektoncd/pipeline v1.10.2→v1.15.0, pipelines-as-code v0.43.0→v0.49.0, and xanzy/go-gitlab v0.108→v0.115.0. Lint and Envtest CI checks are currently failing, which may indicate these bumps introduced breaking API changes requiring corresponding source code updates. Recommend investigating the CI failures to determine whether source code adaptations are needed.

Low

[version inconsistency] go.mod:3 — The main module uses Go 1.26.4 while the e2e-tests module uses Go 1.26.5. These are independent Go modules and patch-level differences are fully compatible — this is standard Renovate behavior when modules are updated on separate schedules.

Previous run (25)

Review

Findings

Low

[version mismatch] go.mod:3 — The main module uses go 1.26.4 while the e2e-tests module uses go 1.26.5. These are separate Go modules with independent compilation, so the practical risk is minimal. However, the mismatch is likely unintentional (Renovate bot applied different versions) and aligning them would reduce maintenance confusion.
Remediation: Align both go.mod files to the same Go version (preferably 1.26.5, the newer patch release).

Previous run (26)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — go.mod contains the comment // If you update dependencies below you must also update internal/controller/suite_test.go. The PR updates tektoncd/pipeline from v1.10.2 to v1.15.0 and pipelines-as-code from v0.43.0 to v0.49.0, but suite_test.go still hardcodes the old versions at lines 89–90. The envtest CRDDirectoryPaths use these version strings to construct filesystem paths to CRD definitions under $GOPATH/pkg/mod. After go mod tidy downloads the new versions, the old versioned directories may not exist, causing the test environment to fail to start with missing CRD errors (since ErrorIfCRDPathMissing: true is set at line 94).
Remediation: Update line 89 from "pipeline@v1.10.2" to "pipeline@v1.15.0" and line 90 from "pipelines-as-code@v0.43.0" to "pipelines-as-code@v0.49.0" in internal/controller/suite_test.go.

Labels: PR is a Renovate dependency version update

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (27)

Review

Findings

High

[API contract violation] go.mod — Kubernetes module version skew: k8s.io/api is bumped to v0.36.3 (likely pulled by sigs.k8s.io/controller-runtime v0.24.1 which depends on k8s v0.36.x) while k8s.io/apimachinery remains at v0.35.0 and k8s.io/client-go is pinned to v0.35.0 via replace directive. The Kubernetes project requires all k8s.io/* modules to be at the same minor version. This 1-minor-version gap can cause compilation errors or runtime type mismatches.
Remediation: Bump k8s.io/apimachinery to v0.36.3 and update the k8s.io/client-go replace directive to v0.36.3, along with other k8s.io indirect dependencies (apiextensions-apiserver, apiserver, component-base). Alternatively, pin all k8s modules back to v0.35.0 and revert the controller-runtime bump.
[API contract violation] e2e-tests/go.mod — Kubernetes module version skew in e2e-tests is even wider: the replace block pins k8s.io/api, k8s.io/apiextensions-apiserver, k8s.io/apiserver, and k8s.io/component-base to v0.36.3, but k8s.io/apimachinery and k8s.io/client-go remain pinned to v0.34.2. This is a 2-minor-version gap that violates the Kubernetes versioning contract and is very likely to cause type incompatibilities at compile time or runtime.
Remediation: Align all k8s.io/* replace directives in e2e-tests/go.mod to v0.36.3, or revert the partially-bumped modules back to v0.34.2.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (28)

Looks good to me

Previous run (29)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The CRD path for tektoncd/pipeline is hardcoded to v1.10.2 but go.mod has been updated to v1.15.0. The comment on go.mod line 30 explicitly warns: "If you update dependencies below you must also update internal/controller/suite_test.go". The envtest environment will fail to find the CRD files because they will be located under the v1.15.0 module directory in $GOPATH, not v1.10.2.
Remediation: Update line 89 to reference pipeline@v1.15.0.
[stale-reference] internal/controller/suite_test.go:90 — The CRD path for pipelines-as-code is hardcoded to v0.43.0 but go.mod has been updated to v0.49.0. The envtest environment will attempt to load CRDs from the old module directory, causing test setup to fail with ErrorIfCRDPathMissing: true.
Remediation: Update line 90 to reference pipelines-as-code@v0.49.0.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (30)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The tektoncd/pipeline dependency was bumped from v1.10.2 to v1.15.0 in go.mod, but the CRD path in suite_test.go still references pipeline@v1.10.2. The go.mod comment on line 30 explicitly warns: "If you update dependencies below you must also update internal/controller/suite_test.go." The envtest environment has ErrorIfCRDPathMissing: true, so integration tests will fail at setup because the v1.10.2 module directory will not exist after go mod download fetches only v1.15.0.
Remediation: Update line 89 to use pipeline@v1.15.0 to match the go.mod dependency version.
[stale-reference] internal/controller/suite_test.go:90 — The pipelines-as-code dependency was bumped from v0.43.0 to v0.49.0 in go.mod, but the CRD path in suite_test.go still references pipelines-as-code@v0.43.0. With ErrorIfCRDPathMissing: true, integration tests will fail because the old module version directory will not be present.
Remediation: Update line 90 to use pipelines-as-code@v0.49.0 to match the go.mod dependency version.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (31)

Looks good to me

Previous run (32)

Review

Findings

Low

[version consistency] e2e-tests/go.mod:3 — The main module uses go 1.26.4 while the e2e-tests module uses go 1.26.5. These are separate Go modules, and since Go 1.21+, the go directive acts as a minimum version requirement rather than a strict constraint. A Go 1.26.5+ toolchain satisfies both modules. The practical risk is minimal, but aligning the versions would be cosmetically cleaner.

Previous run (33)

Looks good to me

Previous run (34)

Looks good to me

Previous run (35)

Review

Findings

Critical

[stale-reference] internal/controller/suite_test.go:89 — The go.mod file contains an explicit comment: "If you update dependencies below you must also update internal/controller/suite_test.go". This PR updates tektoncd/pipeline from v1.10.2 to v1.15.0 and pipelines-as-code from v0.43.0 to v0.49.0, but suite_test.go still hardcodes the old versions at lines 89–90. The envtest environment constructs CRD file paths using these version strings (e.g., filepath.Join(build.Default.GOPATH, "pkg", "mod", ..., "pipeline@v1.10.2", ...)). In a clean CI environment, only the new versions will be in the module cache, so these paths will resolve to non-existent directories, causing all integration tests (envtest) to fail (ErrorIfCRDPathMissing: true).
Remediation: Update internal/controller/suite_test.go line 89 to use pipeline@v1.15.0 and line 90 to use pipelines-as-code@v0.49.0.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (36)

Review

Findings

Medium

[API contract violation] go.mod — go-gitlab jumped 7 minor versions (v0.108.0 → v0.115.0). The codebase uses a struct conversion pattern at pkg/git/gitlab/gitlab_helper.go:395 that casts AddProjectHookOptions to EditProjectHookOptions via gitlab.EditProjectHookOptions(*getPaCWebhookOpts(...)). This relies on the two structs having identical field layouts. If go-gitlab added or changed fields between these versions, this will either fail to compile or silently drop webhook configuration fields. CI is currently failing, which may be related.
Remediation: Verify that CI passes. If struct layouts have diverged, construct EditProjectHookOptions explicitly rather than casting.
[API contract violation] go.mod — tektoncd/pipeline jumped from v1.10.2 to v1.15.0 (5 minor versions), and pipelines-as-code from v0.43.0 to v0.49.0. The codebase uses Tekton API types (PipelineRun, PipelineSpec, PipelineTask, Step, PipelineTaskRunTemplate) across multiple files. CI is currently failing, which may indicate incompatibilities from these or other dependency bumps.
Remediation: Ensure CI (make test) passes. Pay attention to tektonapi.Step usage in internal/controller/renovate_util.go.

Labels: PR is a Renovate bot dependency update modifying go.mod/go.sum

Previous run (37)

Review

Findings

High

[stale hardcoded version] internal/controller/suite_test.go:89 — The CRD directory paths in suite_test.go hardcode old dependency versions that were bumped in this PR. Line 89 references tektoncd/pipeline@v1.10.2 (should be v1.15.0) and line 90 references pipelines-as-code@v0.43.0 (should be v0.49.0). The go.mod file contains a comment on line 30 warning: "If you update dependencies below you must also update internal/controller/suite_test.go". These stale paths will cause the envtest environment to fail to find the CRD files, breaking integration tests.
Remediation: Update line 89 to reference pipeline@v1.15.0 and line 90 to reference pipelines-as-code@v0.49.0. Verify the CRD directory structure has not changed between these version bumps.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (38)

Review

Findings

Critical

[test breakage] internal/controller/suite_test.go:89 — The go.mod comment on line 30 warns: "If you update dependencies below you must also update internal/controller/suite_test.go." This PR bumps tektoncd/pipeline from v1.10.2 to v1.14.1 and openshift-pipelines/pipelines-as-code from v0.43.0 to v0.49.0 in go.mod, but suite_test.go is not updated. Lines 89–90 still hardcode the old versions in CRDDirectoryPaths. With ErrorIfCRDPathMissing: true (line 94), all envtest-based integration tests will fail because the CRD files will not be found at the old version paths in GOPATH/pkg/mod.
Remediation: Update line 89 to reference pipeline@v1.14.1 and line 90 to reference pipelines-as-code@v0.49.0.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (39)

Review

Findings

Medium

[api-contract] go.mod — Significant version jumps across the Kubernetes ecosystem: k8s.io/* v0.35→v0.36.3, controller-runtime v0.23.3→v0.24.1, tektoncd/pipeline v1.10.2→v1.14.1, and pipelines-as-code v0.43.0→v0.49.0. These are minor version bumps that can introduce API deprecation removals, changed validation behavior, or altered CRD schemas not caught by compilation alone. Worth verifying that make test and make lint pass cleanly with these dependency versions.

Low

[api-contract] e2e-tests/go.mod — Go toolchain version mismatch: main module uses Go 1.26.4 while e2e-tests uses Go 1.26.5. This patch-level difference is unlikely to cause issues, but alignment is preferable. The e2e-tests k8s.io replace directives jump from v0.34.2 to v0.36.3, aligning with the main module's target version.
[api-contract] go.mod — Several indirect dependencies were removed (containerd/stargz-snapshotter/estargz, docker/distribution, google/btree, mitchellh/go-homedir, vbatts/tar-split, go.mongodb.org/mongo-driver) and k8s.io/streaming v0.36.3 was added, consistent with upstream dependency tree evolution from the version bumps.
[api-contract] go.mod — github.com/openshift-pipelines/pipelines-as-code bumped from v0.43.0 to v0.49.0 (6 minor versions). As the project's primary integration point for build pipeline management, consider reviewing the PaC changelog for any API type changes affecting Repository CR or webhook handling.

Labels: PR exclusively updates Go module dependencies (go.mod and go.sum files)

Previous run (40)

Looks good to me

Previous run (41)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The go.mod comment at line 30 explicitly states: "If you update dependencies below you must also update internal/controller/suite_test.go." This PR updates tektoncd/pipeline from v1.10.2 to v1.14.1 and pipelines-as-code from v0.43.0 to v0.49.0 in go.mod, but suite_test.go still hardcodes the old versions at lines 89–90. With ErrorIfCRDPathMissing: true (line 94), integration tests will fail because the old versioned paths will not exist in the module cache after go mod download pulls the new versions.
Remediation: Update line 89 to use pipeline@v1.14.1 and line 90 to use pipelines-as-code@v0.49.0 to match the new versions in go.mod.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (42)

Review

Findings

High

[stale reference after dependency update] internal/controller/suite_test.go:89 — The go.mod file has an explicit comment at line 30: "If you update dependencies below you must also update internal/controller/suite_test.go". This PR updates tektoncd/pipeline from v1.10.2 to v1.14.0 and pipelines-as-code from v0.43.0 to v0.49.0 in the guarded dependency block, but suite_test.go is not updated. Lines 89–90 still hardcode the old versions in CRDDirectoryPaths. With ErrorIfCRDPathMissing: true (line 94), envtest will fail at startup because the old module directories will not exist in the module cache, breaking all integration tests.
Remediation: Update line 89 to pipeline@v1.14.0 and line 90 to pipelines-as-code@v0.49.0 to match the new versions in go.mod.

Low

[version inconsistency] e2e-tests/go.mod — The main go.mod uses Go 1.26.4 while e2e-tests/go.mod uses Go 1.26.5. This is a minor inconsistency — likely harmless since these are separate modules, but worth noting as it may be unintentional from the renovate bot.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (43)

Review

Findings

High

[version skew] e2e-tests/go.mod — In the replace directives block, k8s.io/apiextensions-apiserver remains pinned at v0.34.2 while all other k8s.io modules (k8s.io/api, k8s.io/apimachinery, k8s.io/apiserver, k8s.io/client-go, k8s.io/component-base) are bumped to v0.36.3. The indirect require for k8s.io/apiextensions-apiserver was also bumped from v0.35.2 to v0.36.0, but the replace directive overrides it back to v0.34.2. This two-minor-version gap between k8s.io staging modules that share internal types will likely cause compilation errors or runtime incompatibilities. This appears to be a Renovate bot oversight — it updated five of the six k8s.io replace directives but missed this one.
Remediation: Update the k8s.io/apiextensions-apiserver replace directive from v0.34.2 to v0.36.3 (matching the other k8s.io modules) or at minimum to v0.36.0 (matching its require version).

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (44)

Review

Findings

Low

[API contract / breaking change risk] go.mod:35 — Major version bumps in key dependencies (tektoncd/pipeline v1.10.2 → v1.14.1, pipelines-as-code v0.43.0 → v0.49.0, controller-runtime v0.23.3 → v0.24.1, k8s.io/* v0.35 → v0.36) may introduce breaking API changes. Since this is a dependency-only PR with no source code changes and is generated by Renovate bot, CI (compile + tests) is the primary safeguard. No specific breaking change has been identified.
[Version skew] go.mod:1 — The main module uses Go 1.26.4 while e2e-tests uses Go 1.26.5. This is a minor patch-level difference and unlikely to cause issues, but it is worth noting the slight inconsistency. Both are within the 1.26 minor version so toolchain compatibility is maintained.

Previous run (45)

Review

Findings

Critical

[stale-reference] internal/controller/suite_test.go:89 — The PR bumps tektoncd/pipeline from v1.10.2 to v1.14.1 and pipelines-as-code from v0.43.0 to v0.49.0 in go.mod, but suite_test.go hardcodes the old version strings in CRD directory paths (lines 89–90: pipeline@v1.10.2 and pipelines-as-code@v0.43.0). After this PR merges, the Go module cache will contain only the new versions, so envtest.Environment will fail to find CRDs at the old paths. With ErrorIfCRDPathMissing: true (line 94), all integration tests will deterministically fail to start.
Remediation: Update line 89 to reference pipeline@v1.14.1 and line 90 to reference pipelines-as-code@v0.49.0. The go.mod comment on line 30 explicitly warns: "If you update dependencies below you must also update internal/controller/suite_test.go."

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (46)

Looks good to me

Previous run (47)

Looks good to me

Previous run (48)

Review

Findings

Critical

[stale-reference] internal/controller/suite_test.go:89 — The PR updates tektoncd/pipeline from v1.10.2 to v1.14.1 in go.mod, but suite_test.go line 89 hardcodes the CRD path as pipeline@v1.10.2. The go.mod comment explicitly warns: "If you update dependencies below you must also update internal/controller/suite_test.go." With ErrorIfCRDPathMissing: true, the envtest environment will fail to start, breaking all integration tests.
Remediation: Update line 89 to use pipeline@v1.14.1.
[stale-reference] internal/controller/suite_test.go:90 — The PR updates pipelines-as-code from v0.43.0 to v0.49.0 in go.mod, but suite_test.go line 90 hardcodes the CRD path as pipelines-as-code@v0.43.0. With ErrorIfCRDPathMissing: true, the envtest setup will fail, breaking all integration tests.
Remediation: Update line 90 to use pipelines-as-code@v0.49.0.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (49)

Review

Findings

Medium

[version skew] e2e-tests/go.mod:18 — The replace block pins k8s.io/apiextensions-apiserver to v0.34.2 while all other k8s.io modules (api, apimachinery, apiserver, client-go, component-base) have been updated to v0.36.3. This two-minor-version mismatch within the k8s.io module family can cause incompatible type definitions or runtime panics when apiextensions types are passed to or from code using v0.36.3 core types.
Remediation: Update the k8s.io/apiextensions-apiserver replace directive from v0.34.2 to v0.36.3 to match the other k8s.io modules.
[version skew] e2e-tests/go.mod:22 — Within e2e-tests/go.mod, sigs.k8s.io/controller-runtime is pinned at v0.20.2 via a replace directive, but the k8s.io modules in the same replace block have been bumped to v0.36.3. controller-runtime v0.20.x was built against k8s.io v0.32.x. Using it with k8s.io v0.36.3 replaces within the same module will likely produce compilation errors or runtime incompatibilities.
Remediation: Update the sigs.k8s.io/controller-runtime replace directive to a version compatible with k8s.io v0.36.3 (e.g., v0.23.x).

Previous run (50)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The go.mod comment states: "If you update dependencies below you must also update internal/controller/suite_test.go." This PR updates pipelines-as-code from v0.43.0 to v0.49.0 and tektoncd/pipeline from v1.10.2 to v1.14.1, but suite_test.go still references the old versions in filesystem paths used for envtest CRD loading: pipeline@v1.10.2 (line 89) and pipelines-as-code@v0.43.0 (line 90). These paths resolve to the Go module cache and will not resolve after the dependency update, breaking integration tests.
Remediation: Update suite_test.go line 89 to reference pipeline@v1.14.1 and line 90 to reference pipelines-as-code@v0.49.0.

Low

[module-consistency] e2e-tests/go.mod:3 — Go version mismatch between main module (go 1.26.4) and e2e-tests module (go 1.26.5). Not a functional issue (Go toolchain selection handles it), but breaks the codebase convention of synchronized Go versions.
[api-contract] go.mod — Several dependency bumps cross minor release boundaries (k8s 0.35→0.36, controller-runtime 0.23→0.24, tektoncd/pipeline 1.10→1.14, pipelines-as-code 0.43→0.49). Verify CI passes to confirm no breaking API changes affect this codebase.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (51)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:89 — The go.mod comment warns: "If you update dependencies below you must also update internal/controller/suite_test.go." This PR bumps pipelines-as-code from v0.43.0 to v0.49.0 and tektoncd/pipeline from v1.10.2 to v1.14.1, but suite_test.go still hardcodes the old versions in CRD directory paths: line 89 references pipeline@v1.10.2 and line 90 references pipelines-as-code@v0.43.0. These paths are used by envtest to load CRDs from the Go module cache. With the dependencies bumped, the old versioned directories will not exist in the module cache, causing envtest to fail since ErrorIfCRDPathMissing is set to true (line 95).
Remediation: Update suite_test.go line 89 to reference pipeline@v1.14.1 and line 90 to reference pipelines-as-code@v0.49.0 to match the new dependency versions in go.mod.

Medium

[api-contract] go.mod — Several dependency jumps span multiple minor versions: k8s 0.35→0.36, controller-runtime 0.23→0.24, pipelines-as-code 0.43→0.49, tektoncd/pipeline 1.10→1.14. These are significant releases that may contain breaking API changes. The main module uses go 1.26.4 while the e2e-tests submodule uses go 1.26.5 (minor inconsistency across separate modules).
Remediation: Confirm that make test and make lint pass with these dependency updates.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (52)

Review

Findings

Medium

[version inconsistency] e2e-tests/go.mod:24 — The k8s.io/component-base replace directive remains pinned at v0.34.2 while all other k8s.io modules in the same replace block were bumped from v0.34.2 to v0.36.3 by this PR. This introduces a new version skew that did not exist before the PR. Mixing k8s.io module versions two minors apart can cause subtle type incompatibilities at runtime.
Remediation: Update the k8s.io/component-base replace directive to v0.36.3 to match the other k8s.io modules, or confirm that v0.36.3 is not available/compatible and document why this pin is intentional.

Low

[version inconsistency] e2e-tests/go.mod:3 — The e2e-tests module uses Go 1.26.5 while the main module uses Go 1.26.4. This is a cosmetic patch-level discrepancy between two independent modules.
Remediation: Align both go.mod files to the same Go patch version for tidiness.

Previous run (53)

Review

Findings

Medium

[api-contract] e2e-tests/go.mod:26 — k8s.io/component-base is still pinned to v0.34.2 via a replace directive while all other k8s.io modules (api, apimachinery, apiserver, apiextensions-apiserver, client-go) have been bumped to v0.36.3. The main go.mod correctly moves component-base to v0.36.3, suggesting this was an oversight by the bot. Consider updating the replace directive to k8s.io/component-base => k8s.io/component-base v0.36.3 for consistency.

Previous run (54)

Looks good to me

Previous run (55)

Review

Findings

Critical

[stale reference after dependency update] internal/controller/suite_test.go:88 — go.mod explicitly warns (line 30): "If you update dependencies below you must also update internal/controller/suite_test.go". The PR updates tektoncd/pipeline from v1.10.2 to v1.14.1 and pipelines-as-code from v0.43.0 to v0.49.0 in go.mod, but suite_test.go still hardcodes the old versions at lines 88–89. These paths resolve CRDs from the Go module cache ($GOPATH/pkg/mod/...@<version>/...). After the dependency update, the old versioned directories will not exist in the module cache (only the new versions will be downloaded), so envtest.Environment will fail to start with "CRD path missing" errors (ErrorIfCRDPathMissing: true on line 93), breaking all integration tests.
Remediation: Update line 88 to use pipeline@v1.14.1 and line 89 to use pipelines-as-code@v0.49.0 to match the new versions in go.mod.

Low

[version inconsistency] e2e-tests/go.mod:3 — The main go.mod uses Go 1.26.4 while e2e-tests/go.mod uses Go 1.26.5. While these are separate Go modules and different Go toolchain versions are technically valid, having the e2e test module on a newer Go version than the main module is unusual and may indicate an unintentional mismatch in the automated dependency update.

Previous run (56)

Review

Findings

Critical

[stale-reference] internal/controller/suite_test.go:88 — The go.mod comment on line 30 explicitly states: "If you update dependencies below you must also update internal/controller/suite_test.go". The PR updates tektoncd/pipeline from v1.10.2 to v1.14.1 and openshift-pipelines/pipelines-as-code from v0.43.0 to v0.49.0 in go.mod, but suite_test.go is not included in the changed files and still hardcodes the old versions in CRD directory paths (line 88: pipeline@v1.10.2, line 89: pipelines-as-code@v0.43.0). The envtest environment constructs filesystem paths into the Go module cache using these version strings, and ErrorIfCRDPathMissing is set to true on line 93. After the dependency update, only the new version directories will be present in the module cache, so the test setup will fail with CRD path errors, breaking the entire integration test suite.
Remediation: Update line 88 to use pipeline@v1.14.1 and line 89 to use pipelines-as-code@v0.49.0 in internal/controller/suite_test.go to match the new versions in go.mod.

Previous run (57)

Looks good to me

Previous run (58)

Review

Findings

Critical

[stale reference after dependency update] internal/controller/suite_test.go:88 — The CRD directory path for tektoncd/pipeline is hardcoded to v1.10.2, but go.mod was updated to v1.14.1. The go.mod explicitly warns: "If you update dependencies below you must also update internal/controller/suite_test.go". With ErrorIfCRDPathMissing: true (line 93), the envtest environment will fail because the CRD path references a module version that no longer matches go.mod, and go mod download will fetch v1.14.1 not v1.10.2.
Remediation: Update line 88 in internal/controller/suite_test.go from pipeline@v1.10.2 to pipeline@v1.14.1.
[stale reference after dependency update] internal/controller/suite_test.go:89 — The CRD directory path for openshift-pipelines/pipelines-as-code is hardcoded to v0.43.0, but go.mod was updated to v0.49.0. Per the explicit comment in go.mod, this file must be kept in sync. With ErrorIfCRDPathMissing: true, the envtest environment will look for CRDs in a module cache path that no longer matches the downloaded version, causing integration tests to fail.
Remediation: Update line 89 in internal/controller/suite_test.go from pipelines-as-code@v0.43.0 to pipelines-as-code@v0.49.0.

Previous run (59)

Review

Findings

High

[stale-reference] internal/controller/suite_test.go:88 — The go.mod contains an explicit comment: "If you update dependencies below you must also update internal/controller/suite_test.go." The tektoncd/pipeline dependency was updated from v1.10.2 to v1.14.1, but suite_test.go still hardcodes the old version in the CRD path (pipeline@v1.10.2). The envtest environment will fail to find CRDs at the old path, breaking all integration tests.
Remediation: Update line 88 to use pipeline@v1.14.1. Verify that config/300-crds still exists in v1.14.1.
[stale-reference] internal/controller/suite_test.go:89 — The pipelines-as-code dependency was updated from v0.43.0 to v0.49.0, but suite_test.go still hardcodes the old version in the CRD path (pipelines-as-code@v0.43.0). The envtest environment will fail to find CRDs at the old path, breaking all integration tests.
Remediation: Update line 89 to use pipelines-as-code@v0.49.0.

Labels: PR updates Go module dependencies via Renovate bot

Previous run (60)

Review

Findings

Critical

[stale version reference] internal/controller/suite_test.go:88 — The CRD path for tektoncd/pipeline is hardcoded to v1.10.2 but go.mod updates it to v1.14.1. The envtest environment constructs filesystem paths into the Go module cache using these version strings. After this PR, $GOPATH/pkg/mod/github.com/tektoncd/pipeline@v1.10.2/config/300-crds will not exist, and the test suite will fail to start because ErrorIfCRDPathMissing is true (line 93). The go.mod comment on line 30 explicitly warns: "If you update dependencies below you must also update internal/controller/suite_test.go".
Remediation: Update line 88 to use pipeline@v1.14.1 instead of pipeline@v1.10.2.
[stale version reference] internal/controller/suite_test.go:89 — The CRD path for pipelines-as-code is hardcoded to v0.43.0 but go.mod updates it to v0.49.0. The envtest environment constructs filesystem paths into the Go module cache using these version strings. After this PR, $GOPATH/pkg/mod/github.com/openshift-pipelines/pipelines-as-code@v0.43.0/config will not exist, and the test suite will fail to start because ErrorIfCRDPathMissing is true (line 93). The go.mod comment on line 30 explicitly warns: "If you update dependencies below you must also update internal/controller/suite_test.go".
Remediation: Update line 89 to use pipelines-as-code@v0.49.0 instead of pipelines-as-code@v0.43.0.

fullsend-ai-review · 2026-07-24T14:00:51Z

🤖 Finished Review · ❌ Failure · Started 2:00 PM UTC · Completed 2:12 PM UTC
Commit: 37b10e4 · View workflow run →

fullsend-ai-review · 2026-07-24T21:33:18Z

🤖 Finished Review · ✅ Success · Started 9:33 PM UTC · Completed 9:40 PM UTC
Commit: 37b10e4 · View workflow run →

Superseded by updated review

fullsend-ai-review · 2026-07-25T01:32:41Z

🤖 Finished Review · ✅ Success · Started 1:32 AM UTC · Completed 1:39 AM UTC
Commit: 37b10e4 · View workflow run →

fullsend-ai-review · 2026-07-25T06:24:57Z

🤖 Finished Review · ✅ Success · Started 6:24 AM UTC · Completed 6:34 AM UTC
Commit: 37b10e4 · View workflow run →

fullsend-ai-review · 2026-07-25T10:07:06Z

🤖 Finished Review · ✅ Success · Started 10:07 AM UTC · Completed 10:15 AM UTC
Commit: 37b10e4 · View workflow run →

fullsend-ai-review · 2026-07-25T13:38:01Z

🤖 Finished Review · ✅ Success · Started 1:38 PM UTC · Completed 1:44 PM UTC
Commit: 37b10e4 · View workflow run →

Superseded by updated review

fullsend-ai-review · 2026-08-08T14:24:47Z

🤖 Finished Review · ✅ Success · Started 2:24 PM UTC · Completed 2:37 PM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-08T18:19:16Z

🤖 Finished Review · ✅ Success · Started 6:19 PM UTC · Completed 6:27 PM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-08T21:53:22Z

🤖 Finished Review · ✅ Success · Started 9:53 PM UTC · Completed 10:03 PM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-09T02:10:41Z

🤖 Finished Review · ✅ Success · Started 2:10 AM UTC · Completed 2:19 AM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-09T05:57:04Z

🤖 Finished Review · ✅ Success · Started 5:57 AM UTC · Completed 6:06 AM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-09T09:49:53Z

🤖 Finished Review · ✅ Success · Started 9:49 AM UTC · Completed 10:00 AM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-09T14:11:14Z

🤖 Finished Review · ✅ Success · Started 2:11 PM UTC · Completed 2:20 PM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-09T17:38:08Z

🤖 Finished Review · ✅ Success · Started 5:38 PM UTC · Completed 5:44 PM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-09T21:52:56Z

🤖 Finished Review · ✅ Success · Started 9:52 PM UTC · Completed 9:59 PM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-10T02:18:43Z

🤖 Finished Review · ✅ Success · Started 2:18 AM UTC · Completed 2:28 AM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-10T07:16:32Z

🤖 Finished Review · ✅ Success · Started 7:16 AM UTC · Completed 7:23 AM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-11T04:02:03Z

🤖 Finished Review · ✅ Success · Started 4:02 AM UTC · Completed 4:08 AM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-13T03:12:59Z

🤖 Finished Review · ✅ Success · Started 3:12 AM UTC · Completed 3:20 AM UTC

Commit: 1e64447 · View workflow run →

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

fullsend-ai-review · 2026-08-13T06:54:33Z

🤖 Finished Review · ✅ Success · Started 6:54 AM UTC · Completed 7:01 AM UTC

Commit: 1e64447 · View workflow run →

red-hat-konflux Bot requested a review from a team as a code owner July 24, 2026 10:00