chore(deps): batch the safe dependency updates - #36
Conversation
Rolls up the low-risk Dependabot updates into one change so they share a single CI run instead of each invalidating the others under the "branch must be up to date" rule: - github.com/aws/aws-sdk-go-v2 1.41.5 -> 1.42.1 (#27) - github.com/aws/aws-sdk-go-v2/config 1.32.12 -> 1.32.30 (#31) - github.com/aws/aws-sdk-go-v2/.../sts 1.41.9 -> 1.44.1 (#28) - github.com/aws/smithy-go 1.24.2 -> 1.27.4 (#29) - google.golang.org/api 0.272.0 -> 0.289.0 (#30) - github.com/yuin/goldmark (tools) 1.7.8 -> 1.8.4 (#17) - alpine base image 3.20 -> 3.24 (#18) Verified: build, vet, `go test ./...` (137 packages), tools/site-build tests, and golangci-lint (gosec) all pass; regenerating the site with goldmark 1.8.4 produces byte-identical output, so the site-sync guard stays green. Major-version bumps (eslint 10, webpack-cli 7, @types/node 26, the GitHub Action v3->v4/v6->v7 bumps and golang 1.26) are intentionally left open for individual review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reviewer's GuideBatch update of low-risk Go dependencies (AWS SDK v2, Google APIs, OpenTelemetry stack, various x/* and genproto modules), plus Alpine runtime base image and goldmark in tools/site-build, with no application code changes. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe pull request refreshes pinned Go dependencies, upgrades Goldmark for the documentation site build, and changes both Docker runtime images from Alpine 3.20 to Alpine 3.24. ChangesMaintenance refresh
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates various Go dependencies across the project and attempts to upgrade the Alpine base image in the Dockerfiles to version 3.24. However, the reviewer correctly pointed out that Alpine 3.24 is not a released version and its digest is likely hallucinated, which will cause the Docker builds to fail. It is recommended to revert these changes to a stable release like Alpine 3.20 or 3.21.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
|
||
| # Runtime stage | ||
| FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc | ||
| FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b |
There was a problem hiding this comment.
Alpine 3.24 is not a released version of Alpine Linux yet (the current stable release is 3.21). The version 3.24 and its digest appear to be hallucinated by the AI tool used to generate this PR. This will cause the Docker build to fail as the image cannot be pulled. Please revert to alpine:3.20 or upgrade to a valid, released version like alpine:3.21 with a verified digest.
FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
| @@ -1,4 +1,4 @@ | |||
| FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc | |||
| FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b | |||
There was a problem hiding this comment.
Alpine 3.24 is not a released version of Alpine Linux yet (the current stable release is 3.21). The version 3.24 and its digest appear to be hallucinated by the AI tool used to generate this PR. This will cause the Docker build to fail as the image cannot be pulled. Please revert to alpine:3.20 or upgrade to a valid, released version like alpine:3.21 with a verified digest.
FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
1 participant
Rolls up the low-risk Dependabot PRs into a single change. Under
strict: truebranch protection each PR must be up to date before merging, so merging them individually would force a rebase cascade and 7 separate CI runs.aws-sdk-go-v2aws-sdk-go-v2/configaws-sdk-go-v2/service/stssmithy-gogoogle.golang.org/apigoldmark(tools/site-build)alpinebase imageVerified locally:
go build,go vet,go test ./...(137 packages), thetools/site-buildmodule tests, andgolangci-lint(with gosec) all pass. Regenerating the site with goldmark 1.8.4 produces byte-identical output, so the site-sync guard stays green.Dependabot will close the superseded PRs automatically once this lands.
Deliberately not included
Major bumps that need individual review: eslint 9→10 (#34, #26 — already failing
build), webpack-cli 5→7 (#33), @types/node 20→26 (#25), the GitHub Action majors (#19, #20, #22, #23, #24), and golang 1.25.12→1.26.5 (#21, which would put the Docker builder on a different Go minor than CI's pinned 1.25.12).🤖 Generated with Claude Code
Summary by Sourcery
Batch low-risk dependency upgrades across the Go modules and Docker runtime image to keep the project up to date with recent SDK and library releases.
Enhancements:
Build:
Summary by CodeRabbit