Merged
Conversation
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
2 times, most recently
from
d54fcfd to
eda2f1d
Compare
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
2 times, most recently
from
335a38e to
bd6f42c
Compare
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
4 times, most recently
from
9806877 to
73520ce
Compare
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
4 times, most recently
from
bdeba76 to
287eb14
Compare
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
4 times, most recently
from
5e8460e to
6d563bb
Compare
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
4 times, most recently
from
78c978c to
4e8df71
Compare
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
2 times, most recently
from
1d98b78 to
ecbd452
Compare
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
2 times, most recently
from
9d46005 to
6673844
Compare
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
2 times, most recently
from
59a478a to
c3e693e
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/go-dependencies
branch
2 times, most recently
from
7e1622a to
e95e01f
Compare
Align go.mod dependencies to match Zarf v0.74.2 versions.
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Downgrade golang.org/x/tools v0.44.0 → v0.43.0 and golang.org/x/mod v0.35.0 → v0.34.0 to match Zarf v0.74.2.
Upgrade golang.org/x/tools to latest (v0.44.0), which transitively pulls golang.org/x/mod from v0.34.0 to v0.35.0.
Contributor
|
After having a chat in Slack, I aligned critical deps to Zarf and left less related one set to the latest. Alignment Report — uds-cli deps vs Zarf v0.74.2
4 of 7 dependencies are fully aligned with Zarf v0.74.2. The remaining 3 ( |
Contributor
|
Updated Zarf to v0.75.0 and addressed the following breaking API changes:
Below is the full report of the upgrades
7 of 10 dependencies are fully aligned with Zarf v0.75.0. The remaining 3 ( |
1 task
Contributor
|
The final dependency upgrade report: Alignment Report — uds-cli deps vs Zarf v0.75.0
7 of 10 dependencies are fully aligned with Zarf v0.75.0. The remaining 3 ( Breaking changes addressed
Security fix
Transitive dep via |
emoskito
reviewed
Apr 17, 2026
There was a problem hiding this comment.
Pull request overview
Updates Go module dependencies (notably Zarf and Helm) to align uds-cli with Zarf v0.75.0, and adjusts uds-cli code to account for Zarf SDK API changes around OCI layer assembly and package signature verification options.
Changes:
- Bump core/runtime deps (e.g.,
github.com/zarf-dev/zarftov0.75.0,helm.sh/helm/v4tov4.1.4) and refresh transitive modules (including a pgx CVE-related bump). - Migrate signature verification configuration from deprecated
PublicKeyPathtoVerifyBlobOptionsacross load/layout call sites. - Update OCI layer selection logic to match the new
zoci.AssembleLayersAPI and handle skeleton packages by excluding image layers.
Reviewed changes
Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/test/bundles/14-optional-components/uds-bundle.yaml | Updates referenced Zarf init package version to v0.75.0 for tests. |
| src/test/bundles/04-init/uds-bundle.yaml | Updates referenced Zarf init package version to v0.75.0 for tests. |
| src/pkg/utils/utils.go | Introduces helpers for VerifyBlobOptions and updates package signature verification path. |
| src/pkg/utils/boci/oci.go | Updates layer assembly call to new Zarf OCI API; excludes image layers for skeleton packages. |
| src/pkg/sources/tarball.go | Switches layout options to use VerifyBlobOptions derived from the public key path. |
| src/pkg/sources/remote.go | Switches layout options to use VerifyBlobOptions derived from the public key path. |
| src/pkg/bundler/fetcher/remote.go | Switches package load options to use VerifyBlobOptions derived from the public key path. |
| src/pkg/bundler/fetcher/local.go | Switches package load options to use VerifyBlobOptions derived from the public key path. |
| src/pkg/bundle/inspect.go | Switches package load options to use VerifyBlobOptions derived from the public key path. |
| hack/generate-schema.sh | Updates Zarf schema download URL to v0.75.0. |
| go.mod | Bumps direct/indirect dependencies (Zarf, Helm, x/*, pgx pin, etc.). |
| go.sum | Updates checksums for bumped dependencies. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
joelmccoy
previously approved these changes
Apr 17, 2026
mjnagel
approved these changes
Apr 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates Go dependencies, aligning critical runtime deps with Zarf v0.75.0 and keeping build-tooling libraries at their latest versions.
Alignment Report — uds-cli deps vs Zarf v0.75.0
github.com/zarf-dev/zarfv0.74.2v0.75.0v0.75.0helm.sh/helm/v4v4.1.3v4.1.4v4.1.4k8s.io/apiv0.35.3v0.35.3v0.35.3k8s.io/apimachineryv0.35.3v0.35.3v0.35.3k8s.io/client-gov0.35.3v0.35.3v0.35.3github.com/docker/cli(indirect)v29.3.1v29.4.0v29.4.0github.com/fluxcd/source-controller/api(indirect)v1.8.1v1.8.2v1.8.2golang.org/x/exp20251219-944ab1f220260410-746e56fc20251023-a4bb9ffdgolang.org/x/modv0.35.0v0.35.0v0.34.0golang.org/x/tools(indirect)v0.44.0v0.44.0v0.43.07 of 10 dependencies are fully aligned with Zarf v0.75.0. The remaining 3 (
golang.org/x/exp,golang.org/x/mod,golang.org/x/tools) are intentionally ahead at their latest versions. All three are build-tooling/utility libraries with no runtime behavior divergence risk.Breaking changes addressed
zoci.AssembleLayers— removedisSkeletonparameter andzoci.AllLayersconstant; updated call site inboci/oci.golayout.PackageLayoutOptions.PublicKeyPath— deprecated in favor ofVerifyBlobOptions; migrated all 5 call sites and 2 consumers inutils/utils.goSecurity fix
github.com/jackc/pgx/v5(indirect)v5.8.0v5.9.0Transitive dep via
sigstore/cosign→ Zarf. Bumped directly to unblock thegrype-scanCI gate (fail-on-severity: critical).Note
This PR was originally opened by Renovate for
golang.org/x/*, Helm, and k8s patches. It has since been extended to include the Zarf v0.75.0 upgrade with full dependency alignment.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.