fix(gomod): Exclude multi-line exclude directives from extraction#35623
Merged
rarkins merged 2 commits intorenovatebot:mainfrom Apr 30, 2025
Merged
fix(gomod): Exclude multi-line exclude directives from extraction#35623rarkins merged 2 commits intorenovatebot:mainfrom
exclude directives from extraction#35623rarkins merged 2 commits intorenovatebot:mainfrom
Conversation
leipert
commented
Apr 29, 2025
This adds a few unit tests for go.mod directives that are not related to dependencies: `godebug`, `retract` and single-line `exclude`. All of those should be ignored. > The `exclude` directive prevents a module version from being loaded by > the `go` command. > https://go.dev/ref/mod#go-mod-file-exclude Apparently they can be used to e.g. block a specific version of a dependency which has a known vulnerability. Simply updating the `exclude` section doesn't make the most sense as someone wanted to exclude a specific version of a dependency. Note: This commit doesn't fix the behaviour for multi-line excludes, it just increases test coverage to show that single-line excludes are already ignored. References: - https://go.dev/doc/modules/gomod-ref
With renovatebot#28852, suddenly multiline `exclude` directives have been renovated. Given that single-line `exclude` directives are not renovated, this just aligns the behaviour between the two. In a future iteration the `exclude`s could be parsed in order to change the behaviour for renovate with regards to the dependency updates, but it is unclear what that would entail. So simply skipping them could be good enough. Side-note: The regex based parsing seems to be really tricky for a lock file which might contain multi line blocks. One should consider rewriting it in a proper loop. References: - renovatebot#31905
53d23b3 to
0b5bbe1
Compare
exclude directive from dependency updatesexclude directives from extraction
rarkins
reviewed
Apr 30, 2025
rarkins
approved these changes
Apr 30, 2025
viceice
approved these changes
Apr 30, 2025
secustor
approved these changes
Apr 30, 2025
|
🎉 This PR is included in version 40.0.2 🎉 The release is available on: Your semantic-release bot 📦🚀 |
SuperSandro2000
added a commit
to SuperSandro2000/renovate
that referenced
this pull request
May 1, 2025
* upstream/main: (176 commits) build(deps): update aws-sdk-js-v3 monorepo (main) (renovatebot#35660) chore(deps): update docker/dockerfile docker tag to v1.15.1 (main) (renovatebot#35659) fix(deps): update ghcr.io/renovatebot/base-image docker tag to v9.64.3 (main) (renovatebot#35657) chore: thre -> the (renovatebot#35655) chore(deps): update dependency vite to v6.3.4 [security] (main) (renovatebot#35653) build(deps): update dependency glob to v11.0.2 (main) (renovatebot#35649) fix(memCache): disallow http requests in cache to be mutable (renovatebot#35647) fix(gomod): Exclude multi-line `exclude` directives from extraction (renovatebot#35623) docs(config options): rewrite `ignoreScripts` (renovatebot#32171) chore(deps): update python:3.13 docker digest to 884da97 (main) (renovatebot#35645) chore(deps): update python docker tag to v3.13.3 (main) (renovatebot#35276) fix(deps): update ghcr.io/renovatebot/base-image docker tag to v9.64.2 (main) (renovatebot#35644) feat(config)!: validate allowedCommands against post-compiled commands (renovatebot#35564) feat(config)!: create new Config Warning issues each time (renovatebot#35565) feat(autodiscoverFilter)!: support combined negative matches (renovatebot#34707) feat(datasource/maven)!: use latest and release values as tags (renovatebot#35515) feat!: require node v22.13 (renovatebot#34524) chore(deps): update dependency esbuild to v0.25.3 (main) (renovatebot#35637) chore(deps): update python:3.13 docker digest to 19c3e96 (main) (renovatebot#35636) feat(deps): update ghcr.io/renovatebot/base-image docker tag to v9.64.1 (main) (renovatebot#35632) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes & context
chore(gomod): Specs for go.mod directives unrelated to dependencies
This adds a few unit tests for go.mod directives that are not related to
dependencies:
godebug,retractand single-lineexclude. All ofthose should be ignored.
Apparently they can be used to e.g. block a specific version of a
dependency which has a known vulnerability. Simply updating the
excludesection doesn't make the most sense as someone wanted toexclude a specific version of a dependency.
Note: This commit doesn't fix the behaviour for multi-line excludes, it
just increases test coverage to show that single-line excludes are
already ignored.
References:
fix(gomod): Exclude multi-line
excludedirectives from extractionWith #28852, suddenly
multiline
excludedirectives have been renovated.Given that single-line
excludedirectives are not renovated, this justaligns the behaviour between the two. In a future iteration the
excludes could be parsed in order to change the behaviour for renovatewith regards to the dependency updates, but it is unclear what that
would entail.
So simply skipping them could be good enough.
Side-note: The regex based parsing seems to be really tricky for a lock
file which might contain multi line blocks. One should consider
rewriting it in a proper loop.
References:
Documentation (please check one with an [x])
How I've tested my work (please select one)
I have verified these changes via: