Update module github.com/ryancurrah/gomodguard to v2

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/ryancurrah/gomodguard	v1.4.1 → v2.1.3

---

Release Notes

ryancurrah/gomodguard (github.com/ryancurrah/gomodguard)

v2.1.3

Compare Source

v2.1.1

Compare Source

What's Changed

• chore(deps): bump golang.org/x/mod from 0.34.0 to 0.35.0 by @​dependabot[bot] in #​97
• fix: remove replace directive so go install works for v2 CLI by @​ryancurrah in #​100
• chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 by @​dependabot[bot] in #​98

Full Changelog: ryancurrah/gomodguard@v2.1.0...v2.1.1

v2.1.0

Compare Source

Note: v2.0.0 and v2.0.1 have been retracted. Please use v2.1.0 or later.

Breaking changes

New configuration schema. The .gomodguard.yaml format has been redesigned. Run gomodguard migrate to automatically convert a v1 config to v2.

Before (v1):

allowed:
  modules:
    - github.com/foo/bar
  domains:
    - golang.org

blocked:
  modules:
    - github.com/uudashr/go-module:
        recommendations:
          - golang.org/x/mod
        reason: "use the official library"
  versions:
    - github.com/mitchellh/go-homedir:
        version: "<= 1.1.0"
        reason: "old versions have a bug"

  local_replace_directives: true

After (v2):

allowed:
  - module: github.com/foo/bar
  - module: golang.org
    match-type: prefix

blocked:
  - module: github.com/uudashr/go-module
    recommendations:
      - golang.org/x/mod
    reason: "use the official library"
  - module: github.com/mitchellh/go-homedir
    version: "<= 1.1.0"
    reason: "old versions have a bug"

local_replace_directives: true

Key differences:

• allowed.modules and allowed.domains are replaced by a flat list where each entry has a module field and an optional match-type field (exact, prefix, regex)
• blocked.modules and blocked.versions are merged into a single flat list where each entry has a module field
• match_type is now match-type (hyphen, not underscore)
• local_replace_directives moves from blocked to the top level

New features

Layered match type precedence. Rules can now match by exact (default), prefix, or regex. When multiple rules overlap, exact beats prefix beats regex, with longest prefix winning among prefix rules.

Regex support. Block or allow entire namespaces with regex patterns:

blocked:
  - module: "github.com/badcompany/.*"
    match-type: regex
    reason: "not permitted"

local_replace_directives. Block modules with local filesystem replace directives to catch accidental commits of dev overrides. Multi-module repo aware — sibling modules whose replacement path contains a matching go.mod are automatically permitted.

The gomodguard migrate command converts a v1 .gomodguard.yaml to v2 format and prints to stdout.

-version flag. Prints the installed version.

Split module layout. The library (github.com/ryancurrah/gomodguard/v2) and CLI (github.com/ryancurrah/gomodguard/cmd/gomodguard/v2) are now separate Go modules, allowing the library to be imported without pulling in CLI dependencies.

Changelog

• 082be15 feat: use array with module field for allowed and blocked config

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux-kflux-prd-rh02]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'make mod-tidy' has not been added to the allowed list in allowedCommands

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux-kflux-prd-rh02[bot]
Once this PR has been reviewed and has the lgtm label, please assign psav for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: a0ad04b1-b70b-4c4a-9b63-71c29ebe7c34

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@red-hat-konflux-kflux-prd-rh02[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify	96b4ce7	link	true	/test verify

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.