Skip to content

fix(deps): update go-minor-patch - #973

Merged
1 commit merged into
mainfrom
renovate/go-minor-patch
Sep 2, 2026
Merged

fix(deps): update go-minor-patch#973
1 commit merged into
mainfrom
renovate/go-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/buildkite/go-buildkite/v5 v5.12.0v5.13.0 age confidence
github.com/jpillora/chisel v1.11.8v1.12.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

buildkite/go-buildkite (github.com/buildkite/go-buildkite/v5)

v5.13.0

Compare Source

jpillora/chisel (github.com/jpillora/chisel)

v1.12.0

Compare Source

Chisel 1.12.0 is a reliability and security release focused on recovering
cleanly from network and configuration changes, making failures visible, and
hardening unauthenticated surfaces.

This stable release follows three public release candidates. No 1.12-specific
runtime regressions were reported after rc3. The archive corruption reported
for rc1 was fixed in rc2; release CI now integrity-tests every .gz and
.zip before any asset or image is published.

Highlights

  • Fixes the high-CPU failure after disconnected SSH sessions by updating
    x/crypto/ssh, bounding keepalive requests, and closing dead connections
    promptly (#​608).
  • Makes authfile reloads reliable across editor renames and Kubernetes
    ConfigMap swaps. ACL changes apply to new tunnels without interrupting
    established tunnels.
  • Propagates TCP half-close through tunnels, rejects unreachable targets
    instead of presenting dead connections, and recovers UDP exit nodes after
    reaching their flow limit.
  • Adds graceful SIGTERM shutdown with HTTP request draining, safer retry
    behavior, configurable retry intervals, and socks5:// client proxy URLs.
  • Caps pre-authentication WebSocket messages while preserving every valid SSH
    packet, validates auth strings, safely quotes untrusted usernames in logs,
    and requires full fingerprints instead of accepting truncated legacy MD5
    prefixes.
  • Updates x/crypto/ssh to v0.55.0 to address
    GO-2026-6303, with release binaries
    built using Go 1.27.0.
  • Reports real versions for go install builds and adds useful info-level
    session, authentication, and ACL-denial logs.
  • Migrates CLI parsing and help output to opts, including terminal-aware
    formatting and reliable wrapping at narrow widths.
  • Ships verified archives and packages plus ko-built, scratch-based images
    with CA roots for six architectures on Docker Hub and GHCR. Publishing the
    draft release promotes latest, 1, and 1.12 without rebuilding them.

Upgrading from 1.11.x

Four changes may require action:

  1. With --socks5 and --authfile, users who should retain SOCKS5 access need
    an authfile entry matching socks. The wildcard "" continues to match
    everything.
  2. --fingerprint must use the full SHA256 fingerprint, or the full deprecated
    16-octet MD5 colon form. Truncated MD5 prefixes are rejected.
  3. --auth values must use <user>:<pass>; values without a colon now fail at
    startup instead of silently disabling authentication.
  4. A client that exhausts --max-retry-count exits non-zero. Cancellation and
    normal signal-driven shutdown still exit successfully.

The wire protocol remains chisel-v3. Mixed 1.11.x/1.12 deployments continue
to work, with new behavior degrading to the older peer's capabilities.

See Upgrading to 1.12 for
configuration details and the
full 1.12 review
for the complete compatibility analysis.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Monday through Friday (* * * * 1-5)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@renovate
renovate Bot requested review from a team as code owners August 31, 2026 02:05
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@renovate
renovate Bot enabled auto-merge (squash) August 31, 2026 02:05
@socket-security

socket-security Bot commented Aug 31, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedgithub.com/​buildkite/​go-buildkite/​v5@​v5.12.0 ⏵ v5.13.071100100100100
Updatedgithub.com/​jpillora/​chisel@​v1.11.8 ⏵ v1.12.075 -12100100100100

View full report

@buildsworth-bk-app buildsworth-bk-app Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dependency update currently breaks compilation; details are inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 22888, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. Unless repository policy already allows L2 approval, grant it by mentioning @buildsworth-bk (see approval ceiling and L2 approval grant):

  • L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
  • L2 — Standard risk (new UI, additive API fields, refactors). Approved only when repository policy or a verified grant allows it; otherwise comment-only.
  • L3 — High risk (auth, migrations, payments, secrets, perf-critical pipeline paths). Human review always required.

Comment thread go.mod Outdated
github.com/alecthomas/kong v1.16.1
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
github.com/buildkite/go-buildkite/v5 v5.12.0
github.com/buildkite/go-buildkite/v5 v5.14.0

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking: v5.13 removed BuildTest, BuildTestExecution, and BuildTestExecutionsCount, but the preflight package still uses them. The lint, test, and vulncheck jobs now all fail while loading the package with undefined: buildkite.BuildTest, so this revision cannot build. Please either keep v5.12.0 or migrate/remove those callers as part of the bump.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still open — v5.13.0 is still selected while the preflight package references the removed types, and build #3465 again fails lint, test, and vulncheck.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still open — v5.13.0 remains selected while cmd/preflight still references the removed types, and build #3467 again fails lint, test, and vulncheck.

@renovate
renovate Bot force-pushed the renovate/go-minor-patch branch from 4a182cf to 51762be Compare August 31, 2026 04:51
@renovate renovate Bot changed the title fix(deps): update module github.com/buildkite/go-buildkite/v5 to v5.14.0 fix(deps): update module github.com/buildkite/go-buildkite/v5 to v5.13.0 Aug 31, 2026

@buildsworth-bk-app buildsworth-bk-app Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The existing compilation concern is still open; the current Buildkite build fails the same three validation steps.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 22984, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

@renovate renovate Bot changed the title fix(deps): update module github.com/buildkite/go-buildkite/v5 to v5.13.0 fix(deps): update go-minor-patch Sep 1, 2026
@renovate
renovate Bot force-pushed the renovate/go-minor-patch branch from 51762be to ea76f3c Compare September 1, 2026 15:44

@buildsworth-bk-app buildsworth-bk-app Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The existing compilation blocker remains open; no new findings this pass.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 23778, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

@ashmckenzie

Copy link
Copy Markdown
Contributor

With the help of Amp, I pushed up #974 which seems to fix these issues.. WDWT?!

@ashmckenzie ashmckenzie closed this pull request by merging all changes into main in befac2c Sep 2, 2026
@ashmckenzie
ashmckenzie deleted the renovate/go-minor-patch branch September 2, 2026 04:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant