Skip to content

chore(deps): update ocm monorepo go module dependencies (no ctf)#2237

Merged
frewilhelm merged 3 commits into
open-component-model:mainfrom
frewilhelm:fix-2235
Apr 10, 2026
Merged

chore(deps): update ocm monorepo go module dependencies (no ctf)#2237
frewilhelm merged 3 commits into
open-component-model:mainfrom
frewilhelm:fix-2235

Conversation

@frewilhelm

Copy link
Copy Markdown
Contributor

Reverted ocm.software/open-component-model/bindings/go/ctf from v0.4.0 back to v0.3.0 in all 9 consuming modules and ran go mod tidy in each.

Fixes #2235

ocmbot Bot and others added 2 commits April 10, 2026 00:56
Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>
@frewilhelm frewilhelm requested a review from a team as a code owner April 10, 2026 05:48
@netlify

netlify Bot commented Apr 10, 2026

Copy link
Copy Markdown

Deploy Preview for ocm-website canceled.

Name Link
🔨 Latest commit 5d6f159
🔍 Latest deploy log https://app.netlify.com/projects/ocm-website/deploys/69d8b5da0581950008f72028

@github-actions github-actions Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Apr 10, 2026
@coderabbitai

coderabbitai Bot commented Apr 10, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ff4403c3-ec30-462c-b072-f2f446562ab7

📥 Commits

Reviewing files that changed from the base of the PR and between a6aca34 and e95c909.

⛔ Files ignored due to path filters (18)
  • bindings/go/constructor/go.sum is excluded by !**/*.sum
  • bindings/go/descriptor/normalisation/go.sum is excluded by !**/*.sum
  • bindings/go/helm/go.sum is excluded by !**/*.sum
  • bindings/go/input/dir/go.sum is excluded by !**/*.sum
  • bindings/go/input/file/go.sum is excluded by !**/*.sum
  • bindings/go/input/utf8/go.sum is excluded by !**/*.sum
  • bindings/go/oci/go.sum is excluded by !**/*.sum
  • bindings/go/oci/integration/go.sum is excluded by !**/*.sum
  • bindings/go/plugin/go.sum is excluded by !**/*.sum
  • bindings/go/repository/go.sum is excluded by !**/*.sum
  • bindings/go/rsa/go.sum is excluded by !**/*.sum
  • bindings/go/signing/go.sum is excluded by !**/*.sum
  • bindings/go/transfer/go.sum is excluded by !**/*.sum
  • bindings/go/transfer/integration/go.sum is excluded by !**/*.sum
  • bindings/go/transform/go.sum is excluded by !**/*.sum
  • cli/go.sum is excluded by !**/*.sum
  • cli/integration/go.sum is excluded by !**/*.sum
  • kubernetes/controller/go.sum is excluded by !**/*.sum
📒 Files selected for processing (18)
  • bindings/go/constructor/go.mod
  • bindings/go/descriptor/normalisation/go.mod
  • bindings/go/helm/go.mod
  • bindings/go/input/dir/go.mod
  • bindings/go/input/file/go.mod
  • bindings/go/input/utf8/go.mod
  • bindings/go/oci/go.mod
  • bindings/go/oci/integration/go.mod
  • bindings/go/plugin/go.mod
  • bindings/go/repository/go.mod
  • bindings/go/rsa/go.mod
  • bindings/go/signing/go.mod
  • bindings/go/transfer/go.mod
  • bindings/go/transfer/integration/go.mod
  • bindings/go/transform/go.mod
  • cli/go.mod
  • cli/integration/go.mod
  • kubernetes/controller/go.mod

📝 Walkthrough

Walkthrough

This PR updates Go module dependency versions across 18 go.mod files in the OCM project, advancing pseudo-version references for OCM bindings/go packages from commit 69b3fc6 (dated 20260408) to commit a6aca34 (dated 20260409). No code logic or exported APIs are modified.

Changes

Cohort / File(s) Summary
Descriptor and Runtime Bindings
bindings/go/constructor/go.mod, bindings/go/descriptor/normalisation/go.mod, bindings/go/oci/go.mod, bindings/go/oci/integration/go.mod, bindings/go/repository/go.mod, bindings/go/rsa/go.mod
Updated descriptor/runtime and descriptor/normalisation dependencies from 20260408134040-69b3fc617615 to 20260409111948-a6aca34e77a9.
Helm and Input Bindings
bindings/go/helm/go.mod, bindings/go/input/dir/go.mod, bindings/go/input/file/go.mod, bindings/go/input/utf8/go.mod
Updated helm, descriptor/normalisation, and descriptor/runtime dependencies to newer pseudo-versions.
Signing, Plugin, and Transform Bindings
bindings/go/plugin/go.mod, bindings/go/signing/go.mod, bindings/go/transform/go.mod
Updated signing, descriptor/runtime, descriptor/normalisation, and cel dependencies to newer pseudo-versions.
Transfer Bindings
bindings/go/transfer/go.mod, bindings/go/transfer/integration/go.mod
Updated transfer, descriptor/runtime, helm, signing, cel, transform, and related direct/indirect dependencies. Also bumped OpenTelemetry indirect dependencies from v1.42.0 to v1.43.0.
CLI Modules
cli/go.mod, cli/integration/go.mod
Updated 9 OCM bindings/go dependencies (cel, descriptor/normalisation, descriptor/runtime, helm, input/utf8, rsa, signing, transfer, transform) to newer pseudo-versions. Removed direct indirect requirement for go.opentelemetry.io/otel/sdk.
Kubernetes Controller
kubernetes/controller/go.mod
Updated 5 OCM bindings/go dependencies (descriptor/normalisation, descriptor/runtime, helm, rsa, signing) to newer pseudo-versions.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

  • PR #2194: Updates the same OCM go.mod dependency pins across multiple packages to a previous commit revision (20260408), forming a progression of dependency updates.
  • PR #2174: Modifies identical OCM Go module dependency pins (e.g., descriptor/runtime, descriptor/normalisation) across multiple go.mod files, just advancing them to different commit revisions.
  • PR #2075: Introduces comprehensive Go module dependency updates across the codebase, including the transfer binding and related packages being updated here.

Suggested labels

kind/chore, kind/dependency, size/m

Suggested reviewers

  • jakobmoellerdev
  • fabianburth
  • Skarlso

Poem

🐰 Dependencies hop to the newest commit,
Version bumps across the whole submit,
From 69b3fc to a6aca34 they leap,
OCM bindings dance in a harmonic heap,
A simple update, tidy and neat! ✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main change: updating OCM monorepo Go module dependencies across multiple modules with the note that ctf module is excluded from the update.
Description check ✅ Passed The description states the PR reverted the ctf module from v0.4.0 back to v0.3.0 and ran go mod tidy, which directly relates to the changeset of dependency version updates shown in the raw summary.
Linked Issues check ✅ Passed The PR successfully addresses issue #2235 by updating digest versions for ocm Go bindings (cel, descriptor/normalisation, descriptor/runtime, helm, input/utf8, rsa, signing, transfer, transform) from 69b3fc6 to a6aca34, and reverts the ctf module from v0.4.0 to v0.3.0 as intended.
Out of Scope Changes check ✅ Passed All changes are in-scope: multiple go.mod files were updated with dependency versions from digest 69b3fc6 to a6aca34, and ctf module was reverted from v0.4.0 to v0.3.0, with OpenTelemetry version bumps in integration modules that appear to be natural outcomes of go mod tidy.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions github-actions Bot added the size/m Medium label Apr 10, 2026
@frewilhelm frewilhelm enabled auto-merge (squash) April 10, 2026 08:33
@frewilhelm frewilhelm merged commit 4375770 into open-component-model:main Apr 10, 2026
142 of 146 checks passed
@coderabbitai coderabbitai Bot mentioned this pull request Apr 10, 2026
morri-son pushed a commit to morri-son/open-component-model that referenced this pull request Apr 14, 2026
…n-component-model#2237)

Reverted `ocm.software/open-component-model/bindings/go/ctf` from
`v0.4.0` back to `v0.3.0` in all 9 consuming modules and ran `go mod
tidy` in each.

Fixes open-component-model#2235

---------

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>
Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
morri-son pushed a commit to morri-son/open-component-model that referenced this pull request Apr 15, 2026
…n-component-model#2237)

Reverted `ocm.software/open-component-model/bindings/go/ctf` from
`v0.4.0` back to `v0.3.0` in all 9 consuming modules and ran `go mod
tidy` in each.

Fixes open-component-model#2235

---------

Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com>
Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. size/m Medium

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants