chore(deps): bump the golang-x group across 1 directory with 7 updates#5292
Open
dependabot[bot] wants to merge 5 commits into
Open
chore(deps): bump the golang-x group across 1 directory with 7 updates#5292dependabot[bot] wants to merge 5 commits into
dependabot[bot] wants to merge 5 commits into
Conversation
Collaborator
🛠 PR Checks Summary🔴 Pending initial approval by a review team member, or review from tech-staff Manual Checks (for Reviewers):
Read More🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers. ✅ Automated Checks (for Contributors):🔴 Pending initial approval by a review team member, or review from tech-staff ☑️ Contributor Actions:
☑️ Reviewer Actions:
📚 Resources:Debug
|
Member
|
@dependabot recreate |
Bumps the golang-x group with 1 update in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto). Updates `golang.org/x/crypto` from 0.48.0 to 0.50.0 - [Commits](golang/crypto@v0.48.0...v0.50.0) Updates `golang.org/x/mod` from 0.32.0 to 0.34.0 - [Commits](golang/mod@v0.32.0...v0.34.0) Updates `golang.org/x/net` from 0.50.0 to 0.52.0 - [Commits](golang/net@v0.50.0...v0.52.0) Updates `golang.org/x/sync` from 0.19.0 to 0.20.0 - [Commits](golang/sync@v0.19.0...v0.20.0) Updates `golang.org/x/term` from 0.40.0 to 0.42.0 - [Commits](golang/term@v0.40.0...v0.42.0) Updates `golang.org/x/text` from 0.34.0 to 0.36.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.34.0...v0.36.0) Updates `golang.org/x/tools` from 0.41.0 to 0.43.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.41.0...v0.43.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x - dependency-name: golang.org/x/mod dependency-version: 0.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x - dependency-name: golang.org/x/net dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x - dependency-name: golang.org/x/sync dependency-version: 0.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x - dependency-name: golang.org/x/term dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x - dependency-name: golang.org/x/text dependency-version: 0.35.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x - dependency-name: golang.org/x/tools dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x ... Signed-off-by: dependabot[bot] <support@github.com>
5aae546 to
28313b5
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
The `tidy_go_mods` job runs `make tidy`, commits the result, and pushes it back to the dependabot PR's branch. After #5452 added `persist-credentials: false` to the checkout step, the push step fails with "could not read Username for 'https://github.com'" because the `git-auto-commit-action` does a plain `git push` and relies on credentials configured in the local repo by `actions/checkout`. The job already requests `contents: write`; persisting credentials is the intended behavior here.
2 tasks
The checkout step intentionally persists credentials so the git-auto-commit-action below can push back to the dependabot PR. Mark the artipacked finding as ignored so stricter zizmor personas don't report it.
moul
pushed a commit
that referenced
this pull request
May 19, 2026
## Summary The `tidy_go_mods` job in `.github/workflows/meta-dependabot-tidy.yml` runs `make tidy` on dependabot PRs that touch `go.mod`/`go.sum`, then uses `stefanzweifel/git-auto-commit-action` to commit and push the result back to the PR branch. Since #5452 added `persist-credentials: false` to the `actions/checkout` step, every run of this job that produces changes fails at the push step: ``` fatal: could not read Username for 'https://github.com': No such device or address Error: Invalid status code: 128 ``` The auto-commit action does a plain `git push` and relies on the credentials persisted into `.git/config` by `actions/checkout`. With `persist-credentials: false`, no credentials are available and the push fails with exit code 128. The `GITHUB_TOKEN` env var passed to the step is not consumed by recent versions of the action for HTTPS auth. Example failure: https://github.com/gnolang/gno/actions/runs/25812055587/job/76559999785 (PR #5292). This fix flips `persist-credentials` back to `true` (the default) and adds a comment explaining why. The job already requests `contents: write`, so persisting the token is the intended behavior here. zizmor passes on the default persona (the one CI runs). The auditor persona flags this as `artipacked` (low confidence), but that persona is not enabled in CI. ## Test plan - [ ] Wait for the next dependabot bump touching `go.mod`/`go.sum` and confirm the `tidy_go_mods` check passes. - [x] Alternatively, rebase #5292 (or similar) onto this fix and observe the job succeed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the golang-x group with 1 update in the / directory: golang.org/x/crypto.
Updates
golang.org/x/cryptofrom 0.48.0 to 0.50.0Commits
03ca0dcgo.mod: update golang.org/x dependencies8400f4assh: respect signer's algorithm preference in pickSignatureAlgorithm81c6cb3ssh: swap cbcMinPaddingSize to cbcMinPacketSize to get encLength982eaa6go.mod: update golang.org/x dependencies159944fssh,acme: clean up tautological/impossible nil conditionsa408498acme: only require prompt if server has terms of servicecab0f71all: upgrade go directive to at least 1.25.0 [generated]2f26647x509roots/fallback: update bundleUpdates
golang.org/x/modfrom 0.32.0 to 0.34.0Commits
1ac721dgo.mod: update golang.org/x dependenciesfb1fac8all: upgrade go directive to at least 1.25.0 [generated]27761a2go.mod: update golang.org/x dependenciesUpdates
golang.org/x/netfrom 0.50.0 to 0.52.0Commits
316e20cgo.mod: update golang.org/x dependencies9767a42internal/http3: add support for plugging into net/http4a81284http2: update docs to disrecommend this packagedec6603dns/dnsmessage: reject too large of names early during unpack8afa12fhttp2: deprecate write schedulers38019a2http2: add missing copyright header to export_test.go039b87finternal/http3: return error when Write is used after status 304 is set6267c6cinternal/http3: add HTTP 103 Early Hints support to ClientConn591bdf3internal/http3: add HTTP 103 Early Hints support to Server1faa6d8internal/http3: avoid potential race when aborting RoundTripUpdates
golang.org/x/syncfrom 0.19.0 to 0.20.0Commits
ec11c4aerrgroup: fix a typo in the documentation1a58307all: modernize interface{} -> any3172ca5all: upgrade go directive to at least 1.25.0 [generated]Updates
golang.org/x/termfrom 0.40.0 to 0.42.0Commits
52b71d3go.mod: update golang.org/x dependencies9d2dc07go.mod: update golang.org/x dependenciesd954e03all: upgrade go directive to at least 1.25.0 [generated]Updates
golang.org/x/textfrom 0.34.0 to 0.36.0Commits
8577a70go.mod: update golang.org/x dependencies7ca2c6dgo.mod: update golang.org/x dependencies73d1ba9all: upgrade go directive to at least 1.25.0 [generated]Updates
golang.org/x/toolsfrom 0.41.0 to 0.43.0Commits
24a8e95go.mod: update golang.org/x dependencies3dd57fbgopls/internal/mcp: refactor unified diff generationfcc014dcmd/digraph: fix package doc39f0f5ccmd/stress: add -failfast flag063c264gopls/test/integration/misc: add diagnostics to flaky testdeb6130gopls/internal/golang: fix hover panic in raw strings with CRLF5f1186bgopls/internal/analysis/driverutil: remove unnecessary new importsff45494go/analysis: expose GoMod etc. to Pass.Module62daff4go/analysis/passes/inline: fix panic in inlineAlias with instantiated generic...fcb6088x/tools: delete obsolete code