Repository navigation
Conversation
v0.5.2 drops github.com/hashicorp/go-uuid (MPL-2.0), which v0.5.1 has pulled into every consumer of expfmt since prometheus#1015. go-uuid is not on the CNCF license allowlist, so Kubernetes' dependency checks reject prometheus/common v0.73.0; with this bump the module graph is clean again. v0.5.2 declares go 1.27.3, so go get also moves the go directive from 1.26.0 to 1.27.3. CI already runs on Go 1.27.x. Signed-off-by: Davanum Srinivas <davanum@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
go-abnf v0.5.2 (release, pandatix/go-abnf#271) generates its graph node IDs with
crypto/randand no longer requiresgithub.com/hashicorp/go-uuid. v0.5.1, which #1015 brought in, pulled go-uuid into every consumer ofexpfmt. go-uuid is MPL-2.0 and not on the CNCF license allowlist, so Kubernetes' dependency verifier currently rejects prometheus/common v0.73.0 (hack/unwanted-dependencies.jsonlists go-uuid; the periodic check that flagged it isci-kubernetes-dependencies-unwanted). With this bump the indirect requirement disappears fromgo.modandgo.sum.One side effect to call out: v0.5.2 declares
go 1.27.3, sogo getalso moves this module'sgodirective from 1.26.0 to 1.27.3. CI here already runs on Go 1.27.x. If keeping the 1.26 floor matters more, the alternative is to wait for a go-abnf release with a lower directive; I did not want to make that call for you.go build ./...and theexpfmtandmodeltests pass.Drafted with AI assistance; I reviewed and tested the change.