[deps] Update devbox and some go deps #450
Conversation
📝 WalkthroughWalkthroughThis pull request updates multiple Go module files with various dependency version changes. The Changes
Poem
Warning There were issues while running some tools. Please review the errors and either fix the tool’s configuration or disable the tool if it’s a critical failure. 🔧 golangci-lint (1.62.2)Error: unknown linters: 'usetesting', run 'golangci-lint help linters' to see the list of supported linters 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🔇 Additional comments (3)
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
pkg/go.mod (1)
3-5: Update Go Version and Toolchain Directive
The Go version has been bumped to 1.23.0 and a new toolchain directive (toolchain go1.24.0) has been added. Please verify that your CI/build environment supports the new toolchain directive and that these changes are compatible with your overall build process.envsec/go.mod (2)
3-5: Update Go Version and Toolchain Directive
The file now specifies go 1.23.0 and includes a new toolchain entry (toolchain go1.24.0). As with the primary module, please ensure that your build environment and tooling fully support these declarations.
31-78: Upgrades to Indirect Dependencies in the Secondary Require Block
The indirect dependency block has major version bumps and additions:
- Several AWS internal packages (e.g.,
github.com/aws/aws-sdk-go-v2/feature/ec2/imds,internal/configsources,internal/endpoints/v2, etc.) have been updated to their respective newer versions.- Minor libraries such as
github.com/charmbracelet/x/ansi(now v0.8.0),github.com/mattn/go-colorable, andgithub.com/mattn/go-runewidthare also upgraded.- Note that there are some version differences compared to the primary module (for example,
golang.org/x/cryptois v0.35.0 here versus v0.36.0 in the pkg module, andgolang.org/x/oauth2is pinned to v0.19.0 here). If these modules interact or if there is shared usage between packages, please verify that these version differences will not lead to runtime inconsistencies or build conflicts.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (5)
devbox.lockis excluded by!**/*.lockenvsec/go.sumis excluded by!**/*.sumgo.workis excluded by!**/*.workgo.work.sumis excluded by!**/*.sumpkg/go.sumis excluded by!**/*.sum
📒 Files selected for processing (2)
envsec/go.mod(2 hunks)pkg/go.mod(1 hunks)
🔇 Additional comments (3)
pkg/go.mod (2)
8-27: Dependency Version Updates in the Primary Require Block
Several direct dependencies have been updated:
connectrpc.com/connectfrom an earlier version to v1.18.1.github.com/coreos/go-oidc/v3to v3.12.0.github.com/fatih/colorto v1.18.0.github.com/go-jose/go-jose/v3to v3.0.4.github.com/gosimple/slugto v1.15.0.github.com/spf13/cobrato v1.9.1.github.com/stretchr/testifyto v1.10.0.go.jetify.com/typeidupdated to v1.3.0.golang.org/x/oauth2to v0.28.0 andgoogle.golang.org/protobufto v1.36.5.These updates aim to keep your dependencies current. Ensure that the consuming code is tested against these new versions to catch any compatibility issues.
31-53: Dependency Version Updates in the Indirect Require Block
The indirect dependencies have also been updated:
- Upgrades include
github.com/ProtonMail/go-cryptoto v1.1.6,github.com/cloudflare/circlto v1.6.0,github.com/go-jose/go-jose/v4to v4.0.5,github.com/gofrs/uuid/v5to v5.3.1, andgithub.com/google/btreeto v1.1.3.- Additionally, dependencies such as
github.com/klauspost/compress,github.com/mattn/go-colorable,github.com/spf13/pflag,golang.org/x/crypto,golang.org/x/net, andgolang.org/x/syshave been updated to their newer versions.These updates should improve stability and security; however, please double-check that no transitive dependency conflicts are introduced.
envsec/go.mod (1)
7-29: Updated Direct Dependencies in the Primary Require Block
This section includes multiple dependency updates:
connectrpc.com/connectis now at v1.18.1.- The AWS SDK modules have been bumped significantly:
github.com/aws/aws-sdk-go-v2to v1.36.3,github.com/aws/aws-sdk-go-v2/configto v1.29.9,github.com/aws/aws-sdk-go-v2/credentialsto v1.17.62,github.com/aws/aws-sdk-go-v2/service/cognitoidentityto v1.29.1, andgithub.com/aws/aws-sdk-go-v2/service/ssmto v1.57.2.github.com/aws/smithy-gois updated to v1.22.3.- Other changes include updates to
github.com/charmbracelet/lipgloss(now v1.0.0),github.com/fatih/colorto v1.18.0,github.com/muesli/termenvto v0.16.0,github.com/samber/loto v1.49.1,github.com/spf13/cobrato v1.9.1, andgolang.org/x/textto v0.23.0.Make sure that these updates have been verified against your current usage patterns, especially with AWS SDK changes that can have significant API surface adjustments.
mikeland73
force-pushed
the
landau/update-deps
branch
from
1706b7b to
1032f78
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
templates/python-flask/.devbox/virtenv/python/bin/venvShellHook.sh (3)
3-3: Environment Variable Dependencies
Ensure that required environment variables (such asDEVBOX_PROJECT_ROOT,DEVBOX_PACKAGES_DIR, andVENV_DIR) are properly set before executing this script. Otherwise, the script may fail unexpectedly.
13-16: Creating Virtual Environment: Gitignore Update
Thecreate_venvfunction successfully creates a new virtual environment and appends patterns to the.gitignorefile. However, the use ofecho "*\n.*"may not interpret the\nescape sequence as intended in all shells. Consider usingprintffor more reliable formatting.- echo "*\n.*" >> "$VENV_DIR/.gitignore" + printf "*\n.*\n" >> "$VENV_DIR/.gitignore"
18-23: Python Venv Module Compatibility Check
The script checks whether Python supports thevenvmodule, which is a good safeguard. For environments with multiple Python versions, you might consider allowing the override of the Python executable (e.g., via a${PYTHON:-python}variable) to ensure the correct interpreter is used.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (21)
api/devbox.lockis excluded by!**/*.lockapi/ts/devbox.lockis excluded by!**/*.lockdevbox.lockis excluded by!**/*.lockenvsec/devbox.lockis excluded by!**/*.lockenvsec/go.sumis excluded by!**/*.sumgo.work.sumis excluded by!**/*.sumpkg/api/devbox.lockis excluded by!**/*.lockpkg/auth/devbox.lockis excluded by!**/*.lockpkg/go.sumis excluded by!**/*.sumpkg/runx/devbox.lockis excluded by!**/*.locktemplates/deno-fresh/devbox.lockis excluded by!**/*.locktemplates/elixir-phoenix/devbox.lockis excluded by!**/*.locktemplates/hello-go/devbox.lockis excluded by!**/*.locktemplates/php-laravel/devbox.lockis excluded by!**/*.locktemplates/python-flask/devbox.lockis excluded by!**/*.locktypeid/typeid-go/go.sumis excluded by!**/*.sumtypeid/typeid-js/devbox.lockis excluded by!**/*.locktypeid/typeid-sql/devbox.lockis excluded by!**/*.locktypeid/typeid/devbox.lockis excluded by!**/*.locktyson/devbox.lockis excluded by!**/*.locktyson/go.sumis excluded by!**/*.sum
📒 Files selected for processing (6)
envsec/go.mod(3 hunks)pkg/go.mod(3 hunks)templates/python-flask/.devbox/virtenv/bin/venvShellHook.sh(1 hunks)templates/python-flask/.devbox/virtenv/python/bin/venvShellHook.sh(1 hunks)typeid/typeid-go/go.mod(1 hunks)tyson/go.mod(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- templates/python-flask/.devbox/virtenv/bin/venvShellHook.sh
🚧 Files skipped from review as they are similar to previous changes (2)
- pkg/go.mod
- envsec/go.mod
🧰 Additional context used
🪛 Shellcheck (0.10.0)
templates/python-flask/.devbox/virtenv/python/bin/venvShellHook.sh
[warning] 10-10: In POSIX sh, -ef is undefined.
(SC3013)
[warning] 38-38: In POSIX sh, [[ ]] is undefined.
(SC3010)
[warning] 41-41: In POSIX sh, [[ ]] is undefined.
(SC3010)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: monorepo-go
🔇 Additional comments (11)
typeid/typeid-go/go.mod (1)
15-15: Update dependency version for consistency.The dependency
github.com/rogpeppe/go-internalhas been updated tov1.14.1. This aligns with similar updates elsewhere in the repository and helps ensure consistency. Please double-check the dependency’s changelog for any potential breaking changes.tyson/go.mod (4)
11-11: Synchronize dependency version in primary require.The update of
github.com/rogpeppe/go-internaltov1.14.1in the primary require block maintains consistency with other modules. Ensure this change does not conflict with any direct or transitive usage within the module.
17-17: Introduce new indirect dependency: Masterminds Semver.The addition of
github.com/Masterminds/semver/v3 v3.3.1as an indirect dependency should be reviewed to confirm that it meets the project’s semantic versioning needs and is compatible across the dependency graph.
21-21: Update Google pprof dependency version.The
github.com/google/pprofdependency has been updated tov0.0.0-20250302191652-9094ed2288e7, which should provide the latest enhancements and fixes. Verify that this version change is compatible with your profiling tooling and does not introduce regressions.
27-29: Upgrade golang.org/x dependencies for improved consistency.The indirect dependencies for
golang.org/x/sys,golang.org/x/text, andgolang.org/x/toolshave been updated tov0.31.0,v0.23.0, andv0.31.0respectively. This update ensures that the project leverages recent improvements and maintains version consistency. Please verify that these updates do not disrupt dependent functionality.templates/python-flask/.devbox/virtenv/python/bin/venvShellHook.sh (6)
5-7: Virtual Environment Validity Check
Theis_valid_venvfunction correctly verifies that both theactivateandpythonfiles exist in the virtual environment directory.
25-28: Virtual Environment Directory Existence Check
The logic that checks ifVENV_DIRexists and validates it viais_valid_venvis clear and well-structured.
29-32: Idempotency via State File
The use of a state file to determine if the script has already been executed prevents unnecessary re-creation of the virtual environment. This is a solid approach for ensuring idempotency.
50-57: Virtual Environment Creation Fallback
The fallback logic to create a new virtual environment if the directory doesn’t exist or is invalid is straightforward and effective.
33-49:Details
✅ Verification successful
Handling Non-Devbox Virtual Environment with User Prompt
When an existing virtual environment is detected that does not use Devbox Python, the script prompts the user for confirmation before overwriting. However, the use of the Bash-specific[[ $reply =~ ^[Yy]$ ]]and[[ $reply =~ ^[Nn]$ ]]syntax will only work with Bash. With the shebang update to#!/bin/bash, this is acceptable. Alternatively, to ensure POSIX compatibility, consider refactoring this block using acasestatement, for example:- if [[ $reply =~ ^[Yy]$ ]]; then - echo "Overwriting existing virtual environment..." - create_venv - elif [[ $reply =~ ^[Nn]$ ]]; then - echo "Using your existing virtual environment. We recommend changing \$VENV_DIR to a different location" - touch "$STATE_FILE" - exit 0 - else - echo "Invalid input. Exiting..." - exit 1 - fi + case "$reply" in + [Yy]) + echo "Overwriting existing virtual environment..." + create_venv + ;; + [Nn]) + echo "Using your existing virtual environment. We recommend changing \$VENV_DIR to a different location" + touch "$STATE_FILE" + exit 0 + ;; + *) + echo "Invalid input. Exiting..." + exit 1 + ;; + esac
Bash-Specific Syntax is Acceptable in This Context
The current implementation is valid because the script’s shebang has been updated to#!/bin/bash, which guarantees that Bash-specific syntax (like[[ $reply =~ ... ]]) will be supported. While refactoring to acasestatement could improve POSIX portability, it isn’t necessary as long as Bash is used.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 38-38: In POSIX sh, [[ ]] is undefined.
(SC3010)
[warning] 41-41: In POSIX sh, [[ ]] is undefined.
(SC3010)
9-11:Details
✅ Verification successful
Devbox Virtual Environment Verification
Theis_devbox_venvfunction uses the-efoperator to check if two paths reference the same file. Note that-efis not defined in POSIXsh. With the proposed change to#!/bin/bash, this usage becomes acceptable. If full portability is required, consider an alternative method.
Use of -ef is acceptable with the Bash shebang
Theis_devbox_venvfunction’s use of-efto compare file references is valid now that the file uses#!/bin/bash. If portability to POSIX sh is ever needed, please consider a different approach for file equality checking.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 10-10: In POSIX sh, -ef is undefined.
(SC3013)
| #!/bin/sh | ||
| set -eu |
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
Shebang and Shell Options Compatibility
The script later makes use of bash-specific constructs (e.g., the -ef operator and [[ ]] for regex matching). To avoid compatibility issues when running under a pure POSIX shell, consider updating the shebang to use Bash.
-#!/bin/sh
+#!/bin/bashAction Required: Update Shebang to Bash for Compatibility
The file currently declares a POSIX shell with #!/bin/sh even though later script lines use bash-specific constructs (such as the -ef operator and [[ … ]] for regex matching). To prevent runtime errors due to incompatible shell syntax, please update the shebang to explicitly use Bash.
- File:
templates/python-flask/.devbox/virtenv/python/bin/venvShellHook.sh - Suggested Change:
-#!/bin/sh +#!/bin/bash
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| #!/bin/sh | |
| set -eu | |
| #!/bin/bash | |
| set -eu |
2 participants
Summary
How was it tested?
Community Contribution License
All community contributions in this pull request are licensed to the project
maintainers under the terms of the
Apache 2 License.
By creating this pull request I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 License as stated in
the
Community Contribution License.
Summary by CodeRabbit