Repository navigation
fix(deps): patch x/net and support selective indirect updates - #1212
Merged
antoinetoussaint-byte merged 5 commits intoOct 28, 2026
Merged
Conversation
--- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: oras.land/oras-go/v2 dependency-version: 2.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: sigs.k8s.io/kustomize/api dependency-version: 0.21.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: sigs.k8s.io/kustomize/kyaml dependency-version: 0.21.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
antoinetoussaint-byte
changed the title
antoinetoussaint-byte
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The published codefly 0.0.5 companion embeds x/net 0.61.0, affected by GO-2026-6860 and GO-2026-6866. This PR selects x/net 0.62.0 and gRPC 1.85.0 alongside the compatible grouped dependency updates. The obsolete gRPC hold comment is removed. Kubernetes dependency selections remain at the Core-compatible versions.
codefly update deps --dependency module@versionnow supports selecting existing external direct or indirect requirements without upgrading unrelated packages. The automatic outdated list omits indirect dependencies and moved kustomize past Core's compatibility guard. Explicit selection fixes both cases through the normal Go resolver, tidy and audit path. Every selection is validated across the modules before mutation; unknown, duplicate and first-party selections are refused, and modules not requiring a selected dependency are unchanged.Classification: fix in the owning CLI. Reuses the agent dependency planner, moved to
pkg/dependencypins, and the existing update/tidy/audit machinery. No second pinning implementation or publishing path.Docs:
docs/commands.md, generateddocs/cli-reference.md, anddocs/runbooks/cut-a-release.mddescribe the flag and the separate companion publication needed to deliver the executable fix.Validation: real Go resolver/build/tidy test for an indirect-only update and preflight refusal; agent lock pin/rollback tests; CLI reference generation/check all pass. Dependency audits pass with existing reviewed suppressions. The rebuilt binary's govulncheck scan removes both x/net findings; its remaining symbol findings are GO-2026-4887 and GO-2026-4883 (Docker, no fixed version in the current module). Full local suite and vet passed (exit 0). Hosted CI is running. The selective-update regression also exercises the actual command across nested modules, including preflight refusal before any mutation.
Core codefly-dev/core#868 selects fresh companion versions. Merge this CLI fix before publishing from that exact merged Core SHA. Previously published tags remain immutable. FastAPI adoption, service rebuilds and NYL scans remain outstanding.
Post-merge validation: the static Linux/arm64 variant, built with the publisher's
codefly_nosemantic, CGO-disabled and stripped/static flags, embeds x/net 0.62.0and gRPC 1.85.0. Binary govulncheck no longer reports GO-2026-6860 or
GO-2026-6866. Unlike the host build, this scan reports six Docker/OpenPGP
findings (GO-2026-5932, GO-2026-5746, GO-2026-5668, GO-2026-5617,
GO-2026-4887, GO-2026-4883), each with Fixed: N/A. These results are kept
separate from the source audit and do not establish NYL image acceptance.