Skip to content

chore: update dependencies#2614

Merged
chmouel merged 1 commit intotektoncd:mainfrom
chmouel:update-deps
Mar 27, 2026
Merged

chore: update dependencies#2614
chmouel merged 1 commit intotektoncd:mainfrom
chmouel:update-deps

Conversation

@chmouel
Copy link
Copy Markdown
Member

@chmouel chmouel commented Mar 26, 2026

📝 Description of the Change

Updated various project dependencies to their latest versions, including go-github, OpenTelemetry, and Gateway API. Cleaned up removed packages and integrated necessary structural changes for dependency compatibility.

There was change to make it wsa with bitbucket and a trailing slash that was changed in the fakes.

🔗 Linked GitHub Issue

Fixes #

🧪 Testing Strategy

  • Unit tests
  • Integration tests
  • End-to-end tests
  • Manual testing
  • Not Applicable

🤖 AI Assistance

AI assistance can be used for various tasks, such as code generation,
documentation, or testing.

Please indicate whether you have used AI assistance
for this PR and provide details if applicable.

  • I have not used any AI assistance for this PR.
  • I have used AI assistance for this PR.

Important

Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Claude noreply@anthropic.com

✅ Submitter Checklist

  • 📝 My commit messages are clear, informative, and follow the project's How to write a git commit message guide. The Gitlint linter ensures in CI it's properly validated
  • ✨ I have ensured my commit message prefix (e.g., fix:, feat:) matches the "Type of Change" I selected above.
  • ♽ I have run make test and make lint locally to check for and fix any
    issues. For an efficient workflow, I have considered installing
    pre-commit and running pre-commit install to
    automate these checks.
  • 📖 I have added or updated documentation for any user-facing changes.
  • 🧪 I have added sufficient unit tests for my code changes.
  • 🎁 I have added end-to-end tests where feasible. See README for more details.
  • 🔎 I have addressed any CI test flakiness or provided a clear reason to bypass it.
  • If adding a provider feature, I have filled in the following and updated the provider documentation:
    • GitHub App
    • GitHub Webhook
    • Gitea/Forgejo
    • GitLab
    • Bitbucket Cloud
    • Bitbucket Data Center

Updated various project dependencies to their latest versions, including
go-github, OpenTelemetry, and Gateway API. Cleaned up removed packages
and integrated necessary structural changes for dependency
compatibility.

Signed-off-by: Chmouel Boudjnah <chmouel@redhat.com>
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates various dependencies in go.mod and go.sum, including major version bumps for several packages. It also includes a significant refactoring of the strfmt package, specifically in mongo.go, where it decouples from the go.mongodb.org/mongo-driver/bson package by introducing an internal bsonlite package to handle BSON operations. This refactoring improves modularity and reduces external dependencies. The review comments validate these changes, noting that the new interfaces and helper functions like unmarshalBSONString improve type safety and maintainability.

Comment on lines 37 to +94
var (
_ bson.Marshaler = Date{}
_ bson.Unmarshaler = &Date{}
_ bson.Marshaler = Base64{}
_ bson.Unmarshaler = &Base64{}
_ bson.Marshaler = Duration(0)
_ bson.Unmarshaler = (*Duration)(nil)
_ bson.Marshaler = DateTime{}
_ bson.Unmarshaler = &DateTime{}
_ bson.Marshaler = ULID{}
_ bson.Unmarshaler = &ULID{}
_ bson.Marshaler = URI("")
_ bson.Unmarshaler = (*URI)(nil)
_ bson.Marshaler = Email("")
_ bson.Unmarshaler = (*Email)(nil)
_ bson.Marshaler = Hostname("")
_ bson.Unmarshaler = (*Hostname)(nil)
_ bson.Marshaler = IPv4("")
_ bson.Unmarshaler = (*IPv4)(nil)
_ bson.Marshaler = IPv6("")
_ bson.Unmarshaler = (*IPv6)(nil)
_ bson.Marshaler = CIDR("")
_ bson.Unmarshaler = (*CIDR)(nil)
_ bson.Marshaler = MAC("")
_ bson.Unmarshaler = (*MAC)(nil)
_ bson.Marshaler = Password("")
_ bson.Unmarshaler = (*Password)(nil)
_ bson.Marshaler = UUID("")
_ bson.Unmarshaler = (*UUID)(nil)
_ bson.Marshaler = UUID3("")
_ bson.Unmarshaler = (*UUID3)(nil)
_ bson.Marshaler = UUID4("")
_ bson.Unmarshaler = (*UUID4)(nil)
_ bson.Marshaler = UUID5("")
_ bson.Unmarshaler = (*UUID5)(nil)
_ bson.Marshaler = UUID7("")
_ bson.Unmarshaler = (*UUID7)(nil)
_ bson.Marshaler = ISBN("")
_ bson.Unmarshaler = (*ISBN)(nil)
_ bson.Marshaler = ISBN10("")
_ bson.Unmarshaler = (*ISBN10)(nil)
_ bson.Marshaler = ISBN13("")
_ bson.Unmarshaler = (*ISBN13)(nil)
_ bson.Marshaler = CreditCard("")
_ bson.Unmarshaler = (*CreditCard)(nil)
_ bson.Marshaler = SSN("")
_ bson.Unmarshaler = (*SSN)(nil)
_ bson.Marshaler = HexColor("")
_ bson.Unmarshaler = (*HexColor)(nil)
_ bson.Marshaler = RGBColor("")
_ bson.Unmarshaler = (*RGBColor)(nil)
_ bson.Marshaler = ObjectId{}
_ bson.Unmarshaler = &ObjectId{}

_ bson.ValueMarshaler = DateTime{}
_ bson.ValueUnmarshaler = &DateTime{}
_ bson.ValueMarshaler = ObjectId{}
_ bson.ValueUnmarshaler = &ObjectId{}
_ bsonMarshaler = Date{}
_ bsonUnmarshaler = &Date{}
_ bsonMarshaler = Base64{}
_ bsonUnmarshaler = &Base64{}
_ bsonMarshaler = Duration(0)
_ bsonUnmarshaler = (*Duration)(nil)
_ bsonMarshaler = DateTime{}
_ bsonUnmarshaler = &DateTime{}
_ bsonMarshaler = ULID{}
_ bsonUnmarshaler = &ULID{}
_ bsonMarshaler = URI("")
_ bsonUnmarshaler = (*URI)(nil)
_ bsonMarshaler = Email("")
_ bsonUnmarshaler = (*Email)(nil)
_ bsonMarshaler = Hostname("")
_ bsonUnmarshaler = (*Hostname)(nil)
_ bsonMarshaler = IPv4("")
_ bsonUnmarshaler = (*IPv4)(nil)
_ bsonMarshaler = IPv6("")
_ bsonUnmarshaler = (*IPv6)(nil)
_ bsonMarshaler = CIDR("")
_ bsonUnmarshaler = (*CIDR)(nil)
_ bsonMarshaler = MAC("")
_ bsonUnmarshaler = (*MAC)(nil)
_ bsonMarshaler = Password("")
_ bsonUnmarshaler = (*Password)(nil)
_ bsonMarshaler = UUID("")
_ bsonUnmarshaler = (*UUID)(nil)
_ bsonMarshaler = UUID3("")
_ bsonUnmarshaler = (*UUID3)(nil)
_ bsonMarshaler = UUID4("")
_ bsonUnmarshaler = (*UUID4)(nil)
_ bsonMarshaler = UUID5("")
_ bsonUnmarshaler = (*UUID5)(nil)
_ bsonMarshaler = UUID7("")
_ bsonUnmarshaler = (*UUID7)(nil)
_ bsonMarshaler = ISBN("")
_ bsonUnmarshaler = (*ISBN)(nil)
_ bsonMarshaler = ISBN10("")
_ bsonUnmarshaler = (*ISBN10)(nil)
_ bsonMarshaler = ISBN13("")
_ bsonUnmarshaler = (*ISBN13)(nil)
_ bsonMarshaler = CreditCard("")
_ bsonUnmarshaler = (*CreditCard)(nil)
_ bsonMarshaler = SSN("")
_ bsonUnmarshaler = (*SSN)(nil)
_ bsonMarshaler = HexColor("")
_ bsonUnmarshaler = (*HexColor)(nil)
_ bsonMarshaler = RGBColor("")
_ bsonUnmarshaler = (*RGBColor)(nil)
_ bsonMarshaler = ObjectId{}
_ bsonUnmarshaler = &ObjectId{}

_ bsonValueMarshaler = DateTime{}
_ bsonValueUnmarshaler = &DateTime{}
_ bsonValueMarshaler = ObjectId{}
_ bsonValueUnmarshaler = &ObjectId{}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The bsonMarshaler, bsonUnmarshaler, bsonValueMarshaler, and bsonValueUnmarshaler interfaces are now explicitly checked at compile-time. This ensures that all strfmt types correctly implement the necessary BSON marshaling/unmarshaling interfaces, improving type safety and catching potential issues early.

Comment on lines 103 to 105
func (d Date) MarshalBSON() ([]byte, error) {
return bson.Marshal(bson.M{"data": d.String()})
return bsonlite.C.MarshalDoc(d.String())
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The MarshalBSON method for Date now uses bsonlite.C.MarshalDoc. This change is part of the refactoring to decouple from the go.mongodb.org/mongo-driver/bson package and use the new bsonlite internal package for BSON operations. This improves modularity and reduces external dependencies.

References
  1. Avoid introducing circular dependencies between packages, even if it means temporarily duplicating code.

Comment on lines 107 to 124
func (d *Date) UnmarshalBSON(data []byte) error {
var m bson.M
if err := bson.Unmarshal(data, &m); err != nil {
v, err := bsonlite.C.UnmarshalDoc(data)
if err != nil {
return err
}

if data, ok := m["data"].(string); ok {
rd, err := time.ParseInLocation(RFC3339FullDate, data, DefaultTimeLocation)
if err != nil {
return err
}
*d = Date(rd)
return nil
s, ok := v.(string)
if !ok {
return fmt.Errorf("couldn't unmarshal bson bytes value as Date: %w", ErrFormat)
}

return fmt.Errorf("couldn't unmarshal bson bytes value as Date: %w", ErrFormat)
rd, err := time.ParseInLocation(RFC3339FullDate, s, DefaultTimeLocation)
if err != nil {
return err
}
*d = Date(rd)
return nil
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The UnmarshalBSON method for Date now uses bsonlite.C.UnmarshalDoc and includes a type assertion to ensure the unmarshaled value is a string. This change is part of the refactoring to use the bsonlite internal package, improving modularity and handling of BSON data.

Comment on lines 127 to 129
func (b Base64) MarshalBSON() ([]byte, error) {
return bson.Marshal(bson.M{"data": b.String()})
return bsonlite.C.MarshalDoc(b.String())
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The MarshalBSON method for Base64 now uses bsonlite.C.MarshalDoc. This change is part of the refactoring to decouple from the go.mongodb.org/mongo-driver/bson package and use the new bsonlite internal package for BSON operations. This improves modularity and reduces external dependencies.

References
  1. Avoid introducing circular dependencies between packages, even if it means temporarily duplicating code.

Comment on lines +131 to 149
// UnmarshalBSON document into this value.
func (b *Base64) UnmarshalBSON(data []byte) error {
var m bson.M
if err := bson.Unmarshal(data, &m); err != nil {
v, err := bsonlite.C.UnmarshalDoc(data)
if err != nil {
return err
}

if bd, ok := m["data"].(string); ok {
vb, err := base64.StdEncoding.DecodeString(bd)
if err != nil {
return err
}
*b = Base64(vb)
return nil
s, ok := v.(string)
if !ok {
return fmt.Errorf("couldn't unmarshal bson bytes as base64: %w", ErrFormat)
}

vb, err := base64.StdEncoding.DecodeString(s)
if err != nil {
return err
}
return fmt.Errorf("couldn't unmarshal bson bytes as base64: %w", ErrFormat)
*b = Base64(vb)
return nil
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The UnmarshalBSON method for Base64 now uses bsonlite.C.UnmarshalDoc and includes a type assertion to ensure the unmarshaled value is a string. This change is part of the refactoring to use the bsonlite internal package, improving modularity and handling of BSON data.

Comment on lines 538 to 540

// MarshalBSON document from this value
// MarshalBSON document from this value.
func (h HexColor) MarshalBSON() ([]byte, error) {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The MarshalBSON method for RGBColor now uses bsonlite.C.MarshalDoc. This change is part of the refactoring to decouple from the go.mongodb.org/mongo-driver/bson package and use the new bsonlite internal package for BSON operations. This improves modularity and reduces external dependencies.

References
  1. Avoid introducing circular dependencies between packages, even if it means temporarily duplicating code.

Comment on lines 543 to 549

// UnmarshalBSON document into this value
// UnmarshalBSON document into this value.
func (h *HexColor) UnmarshalBSON(data []byte) error {
var m bson.M
if err := bson.Unmarshal(data, &m); err != nil {
s, err := unmarshalBSONString(data, "HexColor")
if err != nil {
return err
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The UnmarshalBSON method for RGBColor now uses unmarshalBSONString. This change is part of the refactoring to use the bsonlite internal package, improving modularity and handling of BSON data.

Comment on lines 552 to +554
}

// MarshalBSON document from this value
// MarshalBSON document from this value.
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The MarshalBSON method for ObjectId now uses bsonlite.C.MarshalDoc. This change is part of the refactoring to decouple from the go.mongodb.org/mongo-driver/bson package and use the new bsonlite internal package for BSON operations. This improves modularity and reduces external dependencies.

References
  1. Avoid introducing circular dependencies between packages, even if it means temporarily duplicating code.

Comment on lines 557 to +566
}

// UnmarshalBSON document into this value
// UnmarshalBSON document into this value.
func (r *RGBColor) UnmarshalBSON(data []byte) error {
var m bson.M
if err := bson.Unmarshal(data, &m); err != nil {
s, err := unmarshalBSONString(data, "RGBColor")
if err != nil {
return err
}

if ud, ok := m["data"].(string); ok {
*r = RGBColor(ud)
return nil
}
return fmt.Errorf("couldn't unmarshal bson bytes as RGBColor: %w", ErrFormat)
*r = RGBColor(s)
return nil
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The UnmarshalBSON method for ObjectId now uses bsonlite.C.UnmarshalDoc and includes a type assertion to ensure the unmarshaled value is a [12]byte. This change is part of the refactoring to use the bsonlite internal package, improving modularity and handling of BSON data.

Comment on lines +589 to +592
// MarshalBSONValue marshals the [ObjectId] as a raw BSON ObjectID value.
func (id ObjectId) MarshalBSONValue() (byte, []byte, error) {
oid := [12]byte(id)
return bsonlite.TypeObjectID, oid[:], nil
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The MarshalBSONValue method for ObjectId now returns bsonlite.TypeObjectID. This change is part of the refactoring to use the bsonlite internal package, improving modularity and handling of BSON data.

@gemini-code-assist
Copy link
Copy Markdown

Warning

Gemini encountered an error creating the review. You can try again by commenting /gemini review.

@chmouel
Copy link
Copy Markdown
Member Author

chmouel commented Mar 27, 2026

gemini review doing the deps review 🙃

Copy link
Copy Markdown
Member

@theakshaypant theakshaypant left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gemini needs to chill!


for key, value := range dirs {
urlp := "/repositories/" + event.Organization + "/" + event.Repository + "/src/" + sha + "/" + key + "/"
urlp := "/repositories/" + event.Organization + "/" + event.Repository + "/src/" + sha + "/" + key
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No URL sanitisation by bb?! 🤔

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

they changed things, which failed the unittests :\

@chmouel chmouel merged commit 1c44713 into tektoncd:main Mar 27, 2026
20 of 21 checks passed
@chmouel chmouel deleted the update-deps branch March 27, 2026 09:05
@chmouel
Copy link
Copy Markdown
Member Author

chmouel commented Mar 27, 2026

hopefully this will finally clear the security issues on the repo that is flagge ccurrently

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants