Skip to content

fix(deps): update module gopkg.in/resty.v1 to v2#242

Open
red-hat-konflux-kflux-prd-rh02[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/gopkg.in-resty.v1-2.x
Open

fix(deps): update module gopkg.in/resty.v1 to v2#242
red-hat-konflux-kflux-prd-rh02[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/gopkg.in-resty.v1-2.x

Conversation

@red-hat-konflux-kflux-prd-rh02

@red-hat-konflux-kflux-prd-rh02 red-hat-konflux-kflux-prd-rh02 Bot commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
gopkg.in/resty.v1 v1.12.0 → v2.17.2 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

go-resty/resty (gopkg.in/resty.v1)

v2.17.2

Compare Source

Release Notes

Backport

Release

Full Changelog: go-resty/resty@v2.17.1...v2.17.2

v2.17.1

Compare Source

Release Notes

Bug Fixes

Full Changelog: go-resty/resty@v2.17.0...v2.17.1

v2.17.0

Compare Source

Release Notes

Bug Fixes

Backport

Release Updates

New Contributors

Full Changelog: go-resty/resty@v2.16.5...v2.17.0

v2.16.5

Compare Source

Release Notes

Bug Fixes

Documentation

Full Changelog: go-resty/resty@v2.16.4...v2.16.5

v2.16.4

Compare Source

Release Notes

Bug Fixes

Documentation

New Contributors

Full Changelog: go-resty/resty@v2.16.3...v2.16.4

v2.16.3

Compare Source

Release Notes

  • chore(deps, release): update go mod, version bump and readme update by @​jeevatkm in #​946

Full Changelog: go-resty/resty@v2.16.2...v2.16.3

v2.16.2

Compare Source

Release Notes

Bug Fixes

Full Changelog: go-resty/resty@v2.16.1...v2.16.2

v2.16.1

Compare Source

Release Notes

Bug Fixes

  • fix: buffer reset issue in io.Reader with content length enabled and release v2.16.1 by @​jeevatkm in #​918

Full Changelog: go-resty/resty@v2.16.0...v2.16.1

v2.16.0

Compare Source

Release Notes

New Features

Enhancements

Documentation

New Contributors

Full Changelog: go-resty/resty@v2.15.3...v2.16.0

v2.15.3

Compare Source

Release Notes

Bug Fixes

  • fix: 'invalid memory address or nil pointer dereference' in response logger by @​matlockx in #​872

Documentation

New Contributors

Full Changelog: go-resty/resty@v2.15.2...v2.15.3

v2.15.2

Compare Source

Release Notes

Bug Fixes

Documentation

Full Changelog: go-resty/resty@v2.15.1...v2.15.2

v2.15.1

Compare Source

Release Notes

Bug Fixes

Documentation

Full Changelog: go-resty/resty@v2.15.0...v2.15.1

v2.15.0

Compare Source

Release Notes

New Features

Enhancements

Bug Fixes

  • Fix request/response logging for SetDoNotParseResponse(true) by @​kon3gor in #​836
  • fix(enhancement): add explicit option to enable generate curl command in conjunction with debug mode and few clean ups #​828 by @​jeevatkm in #​842

Build

Documentation

New Contributors

Full Changelog: go-resty/resty@v2.14.0...v2.15.0

v2.14.0

Compare Source

Release Notes

New Features

  • feat(curl): generate curl cmd for request && example for curl cmd by @​ahuigo in #​794

Enhancements

Upstream Fixes

Test Cases

Documentation

New Contributors

Full Changelog: go-resty/resty@v2.13.1...v2.14.0

v2.13.1

Compare Source

Release Notes

Fixes

  • fix: correct resty version number which was missed in the previous release by @​jeevatkm in #​793

Full Changelog: go-resty/resty@v2.13.0...v2.13.1

v2.13.0

Compare Source

Release Notes

Enhancements

Bug Fixes

New Contributors

Full Changelog: go-resty/resty@v2.12.0...v2.13.0

v2.12.0

Compare Source

Release Notes

Enhancements

Bug Fixes

Documentation

New Contributors

Full Changelog: go-resty/resty@v2.11.0...v2.12.0

v2.11.0: Release

Compare Source

Release Notes

Bug Fixes

New Contributors

Full Changelog: go-resty/resty@v2.10.0...v2.11.0

v2.10.0: Release

Compare Source

Release Notes

Optimizations

Enhancements

Bug Fixes

New Contributors

Full Changelog: go-resty/resty@v2.9.1...v2.10.0

v2.9.1: Release

Compare Source

Release Notes

Full Changelog: go-resty/resty@v2.9.0...v2.9.1

v2.9.0: Release

Compare Source

Release Notes

New Features

Enhancements

Bug Fixes

Test Cases

Documentation

New Contributors

Full Changelog: go-resty/resty@v2.8.0...v2.9.0

v2.8.0: Release

Compare Source

Release Notes

New Features

Enhancements

Bug Fixes

Documentation

Build

Deprecated Removal

  • Remove usages of deprecated io/ioutil by @​segevda in #​625 (go minimum version go1.16)

New Contributors

Full Changelog: go-resty/resty@v2.7.0...v2.8.0

v2.7.0: Release

Compare Source

Release Notes

Enhancements
Bug Fixes
Tests
Documentation

v2.6.0: Release

Compare Source

Release Notes

Features
Enhancements
General
  • Addressing checksum issue on v2.5.0 with this release

v2.5.0: Release

Compare Source

Release Notes

Bug Fixes

v2.4.0: Release

Compare Source

Release Notes

Features
Enhancements
Bug Fixes
Documentation

v2.3.0: Release

Compare Source

Release Notes

New Features

Enhancements

Bug Fixes

v2.2.0: Release

Compare Source

Release Notes

Enhancements

Bug Fixes

Documentation

v2.1.0: Release

Compare Source

Release Notes

Enhancements

  • Added support for func http.Request.GetBody, so request body manipalation can be done via PreRequestHook (such as adding Content-MD5 entity-header, etc) #​242 @​jeevatkm
  • Added SetCookie and SetCookies method added into Request object #​257 @​jeevatkm
  • Updated default JSON request content-type value without charset per RFC e.g., application/json #​258 @​jeevatkm
  • Reducing memory allocation during debug log processing PR #​277 @​vivekv96
  • Code improvements @​jeevatkm

Bug Fixes

v2.0.0: Release

Compare Source

Release Notes

How to use Resty v2?

Please refer to README

New Features

Enhancements

  • Build User-Agent string only once PR #​221 @​moorereason
  • Retry Backoff algorthim and follow enhancement PR #​237 @​neganovalexey
  • Log request and response debug log together for easy debugging, its highly helpful for parallel #​218 @​jeevatkm
  • Default values set while http.Transport creation simliar to Langauge default client #​212 @​jeevatkm
    • Timeout, KeepAlive, MaxIdleConns, IdleConnTimeout, TLSHandshakeTimeout, ExpectContinueTimeout, MaxIdleConnsPerHost
  • Added support to multipart/form-data payload without filename and content type values PR #​236 @​larryhu
  • Added HTTP verb PATCH into multipart support #​239 @​jeevatkm

Breaking Changes - Migrating v1.x to v2

  • Resty v2 import path have changed to github.com/go-resty/resty #​215 @​jeevatkm
    • Resty v1 import path is not affected.
  • Resty Default Client approach have been removed. Create an instance of Resty client with appropriate settings for usage #​232 @​jeevatkm
  • PreRequestHook signature have been updated to func(cl *Client, r *http.Request) error #​217 @​jeevatkm
  • Retry condition function signature updated to RetryConditionFunc func(*Response, error) bool #​237, #​214 @​neganovalexey, [@​jeevatkm](https://re

Configuration

📅 Schedule: Branch creation - "on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux-kflux-prd-rh02
fix(deps): update module gopkg.in/resty.v1 to v2
bff9a2c 
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
@red-hat-konflux-kflux-prd-rh02

red-hat-konflux-kflux-prd-rh02 Bot commented Jun 22, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: gopkg.in/resty.v2@v2.17.2: parsing go.mod:
	module declares its path as: github.com/go-resty/resty/v2
	        but was required as: gopkg.in/resty.v2

@openshift-ci openshift-ci Bot requested review from sherine-k and tirthct June 22, 2026 16:07
@openshift-ci

openshift-ci Bot commented Jun 22, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ldornele for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci

openshift-ci Bot commented Jun 22, 2026

Copy link
Copy Markdown

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@coderabbitai

coderabbitai Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
📝 Walkthrough

Summary by CodeRabbit

  • Chores
    • Updated internal dependencies to improve system reliability and stability.

Walkthrough

go.mod replaces the direct dependency gopkg.in/resty.v1 v1.12.0 with gopkg.in/resty.v2 v2.17.2. This is a major-version module path change (resty.v1 → resty.v2), not a semver bump within the same module. No other directives are modified in this diff.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Supply chain surface (CWE-1104 / CWE-829):

  • resty.v1 is effectively unmaintained. The v1.12.0 pin dates to 2019. Unmaintained HTTP client libraries on a Go/K8s platform are a direct supply chain risk.
  • Verify go.sum entries for gopkg.in/resty.v2 v2.17.2 are present and match the expected checksums from the Go checksum database (sum.golang.org). A go.mod bump without a matching go.sum update is an incomplete, untrusted state.
  • Missing from this diff: go.sum changes. Confirm go.sum was regenerated (go mod tidy) and committed. A detached go.mod edit without go.sum regeneration leaves the build in an inconsistent state and can mask substitution attacks.
  • resty.v1 had no formal CVE tracking. resty.v2 v2.17.2 should be verified against the OSV database (osv.dev) for any known advisories at time of merge.
  • The API call sites using resty.v1 must be updated to the v2 API — this diff shows no corresponding source changes. If callers still import gopkg.in/resty.v1, the build will fail, implying either those call sites exist elsewhere in the PR or this go.mod edit is incomplete. Confirm no dangling v1 imports remain (grep -r "resty.v1" .).
🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately reflects the main change: updating gopkg.in/resty.v1 from v1.12.0 to v2.17.2, which is a major version upgrade.
Description check ✅ Passed The description provides comprehensive context about the dependency update, including release notes, bug fixes, security patches (CVE-2021-43565, CVE-2022-27191, CVE-2023-45288), and breaking changes for the v1→v2 migration.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output ✅ Passed Production code contains no log statements exposing tokens, passwords, credentials, or secrets. Resty is imported only in test files; masking middleware redacts sensitive headers and JSON fields in...
No Hardcoded Secrets ✅ Passed PR updates resty dependency only. No hardcoded secrets, API keys, tokens, passwords, or credentials detected. All test credentials use placeholder values ("test"). JWT keys loaded from files, not h...
No Weak Cryptography ✅ Passed No weak cryptographic primitives (crypto/md5, crypto/des, crypto/rc4, insecure SHA1, ECB mode) found in repository code. Dependency update only; resty v2.17.2 digest auth uses MD5 legitimately per...
No Injection Vectors ✅ Passed No injection vectors detected. SQL concatenation uses hardcoded table names only. No exec.Command, template.HTML(), or unsafe yaml.Unmarshal patterns found in codebase.
No Privileged Containers ✅ Passed PR only modifies go.mod (dependency update); does not introduce or modify any K8s/OpenShift manifests, Helm templates, or Dockerfiles. Check not applicable.
No Pii Or Sensitive Data In Logs ✅ Passed PR only updates go.mod dependency; application logging already masks PII/sensitive data via MaskingMiddleware before log output. Request/response bodies not logged.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch konflux/mintmaker/main/gopkg.in-resty.v1-2.x
✨ Simplify code
  • Create PR with simplified code
  • Commit simplified code in branch konflux/mintmaker/main/gopkg.in-resty.v1-2.x

Comment @coderabbitai help to get the list of available commands and usage tips.

coderabbitai[bot]
coderabbitai Bot reviewed Jun 22, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 41: The go.mod file has been updated to pin resty.v2, but five test files
still import the v1 version which causes a module graph conflict. Update the
import statements in the following test files to use gopkg.in/resty.v2 instead
of gopkg.in/resty.v1: clusters_test.go, metadata_test.go, node_pools_test.go,
openapi_test.go, and wifconfigs_test.go. Replace each occurrence of
"gopkg.in/resty.v1" with "gopkg.in/resty.v2" in the import sections of these
files, then verify the resty.v2 API usage is compatible with the existing test
code.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c282ed83-8ba0-4115-880a-ff98a0698959

📥 Commits

Reviewing files that changed from the base of the PR and between b429415 and bff9a2c.

📒 Files selected for processing (1)
  • go.mod
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)

Comment thread go.mod
go.opentelemetry.io/otel/trace v1.43.0
go.uber.org/mock v0.6.0
gopkg.in/resty.v1 v1.12.0
gopkg.in/resty.v2 v2.17.2

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n --glob '!**/vendor/**' 'gopkg\.in/resty\.v1' .

Repository: openshift-hyperfleet/hyperfleet-api

Length of output: 563

go.mod pins resty.v2 but five test files still import resty.v1 — build will fail.

go.mod now contains only gopkg.in/resty.v2 v2.17.2, but the following test files still import gopkg.in/resty.v1:

  • test/integration/clusters_test.go:16
  • test/integration/metadata_test.go:26
  • test/integration/node_pools_test.go:11
  • test/integration/openapi_test.go:26
  • test/integration/wifconfigs_test.go:12

Without simultaneous migration of these imports to resty.v2, the module graph cannot satisfy v1 imports and tests will not compile or run.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 41, The go.mod file has been updated to pin resty.v2, but
five test files still import the v1 version which causes a module graph
conflict. Update the import statements in the following test files to use
gopkg.in/resty.v2 instead of gopkg.in/resty.v1: clusters_test.go,
metadata_test.go, node_pools_test.go, openapi_test.go, and wifconfigs_test.go.
Replace each occurrence of "gopkg.in/resty.v1" with "gopkg.in/resty.v2" in the
import sections of these files, then verify the resty.v2 API usage is compatible
with the existing test code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments

@sherine-k sherine-k Awaiting requested review from sherine-k

@tirthct tirthct Awaiting requested review from tirthct

Assignees

No one assigned

Labels

needs-ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants