[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/genproto	indirect	digest	a0af3ef → 2ffab32

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/go.sum

Command failed: go get -t ./...
go: downloading github.com/sirupsen/logrus v1.9.3
go: downloading github.com/spf13/viper v1.8.1
go: downloading github.com/stretchr/testify v1.11.1
go: downloading github.com/cockroachdb/errors v1.11.1
go: downloading github.com/spf13/cobra v1.5.0
go: downloading github.com/spf13/cast v1.5.1
go: downloading gorm.io/gorm v1.25.5
go: downloading github.com/go-playground/validator/v10 v10.20.0
go: downloading github.com/go-sql-driver/mysql v1.7.1
go: downloading gorm.io/driver/mysql v1.5.1
go: downloading gorm.io/driver/postgres v1.5.2
go: downloading github.com/viant/afs v1.16.0
go: downloading github.com/magiconair/properties v1.8.5
go: downloading github.com/merico-ai/graphql v0.0.0-20260206020408-b7fd267bcfac
go: downloading github.com/mitchellh/mapstructure v1.5.0
go: downloading golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0
go: downloading github.com/panjf2000/ants/v2 v2.4.6
go: downloading cloud.google.com/go/storage v1.56.0
go: downloading github.com/coreos/go-oidc/v3 v3.9.0
go: downloading cloud.google.com/go v0.123.0
go: downloading google.golang.org/api v0.288.0
go: downloading github.com/gin-gonic/gin v1.9.1
go: downloading github.com/golang-jwt/jwt/v5 v5.2.2
go: downloading golang.org/x/oauth2 v0.36.0
go: downloading golang.org/x/sync v0.22.0
go: downloading github.com/rogpeppe/go-internal v1.14.1
go: downloading gorm.io/datatypes v1.0.1
go: downloading github.com/fsnotify/fsnotify v1.4.9
go: downloading github.com/hashicorp/hcl v1.0.0
go: downloading github.com/pelletier/go-toml v1.9.3
go: downloading github.com/spf13/afero v1.15.0
go: downloading github.com/spf13/jwalterweatherman v1.1.0
go: downloading github.com/spf13/pflag v1.0.5
go: downloading github.com/subosito/gotenv v1.2.0
go: downloading gopkg.in/ini.v1 v1.67.0
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading golang.org/x/sys v0.47.0
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b
go: downloading github.com/cockroachdb/redact v1.1.5
go: downloading github.com/getsentry/sentry-go v0.18.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/inconshreveable/mousetrap v1.0.0
go: downloading github.com/tidwall/gjson v1.14.3
go: downloading github.com/jinzhu/now v1.1.5
go: downloading github.com/gabriel-vasile/mimetype v1.4.7
go: downloading github.com/go-playground/universal-translator v0.18.1
go: downloading github.com/leodido/go-urn v1.4.0
go: downloading golang.org/x/crypto v0.55.0
go: downloading golang.org/x/text v0.41.0
go: downloading github.com/jackc/pgx/v5 v5.6.0
go: downloading github.com/jinzhu/inflection v1.0.0
go: downloading golang.org/x/mod v0.38.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/chainguard-dev/git-urls v1.0.2
go: downloading github.com/libgit2/git2go/v33 v33.0.6
go: downloading github.com/go-git/go-git/v5 v5.12.0
go: downloading golang.org/x/net v0.58.0
go: downloading github.com/go-jose/go-jose/v3 v3.0.1
go: downloading cloud.google.com/go/auth v0.20.0
go: downloading cloud.google.com/go/compute/metadata v0.9.0
go: downloading cloud.google.com/go/iam v1.15.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/googleapis/gax-go/v2 v2.26.2
go: downloading go.opentelemetry.io/contrib/detectors/gcp v1.44.0
go: downloading go.opentelemetry.io/otel v1.45.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.45.0
go: downloading go.opentelemetry.io/otel/sdk v1.45.0
go: downloading go.opentelemetry.io/otel/trace v1.45.0
go: downloading google.golang.org/genproto v0.0.0-20261026165753-2ffab32bce7e
go: downloading google.golang.org/grpc v1.83.2
go: downloading google.golang.org/protobuf v1.36.12
go: downloading github.com/gin-contrib/sse v0.1.0
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/snowflakedb/gosnowflake v1.19.1
go: downloading github.com/gocarina/gocsv v0.0.0-20220707092902-b9da1f06c77e
go: downloading golang.org/x/tools v0.48.0
go: downloading github.com/aws/aws-sdk-go v1.55.6
go: downloading github.com/lib/pq v1.10.2
go: downloading github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20260708090559-a0c568e41e08
go: downloading github.com/gin-contrib/cors v1.7.2
go: downloading github.com/swaggo/files v1.0.1
go: downloading github.com/swaggo/gin-swagger v1.6.0
go: downloading github.com/swaggo/swag v1.16.1
go: downloading github.com/robfig/cron/v3 v3.0.0
go: downloading github.com/gogo/protobuf v1.3.2
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/tidwall/match v1.1.1
go: downloading github.com/tidwall/pretty v1.2.0
go: downloading github.com/go-playground/locales v0.14.1
go: downloading github.com/jackc/pgpassfile v1.0.0
go: downloading github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a
go: downloading github.com/go-errors/errors v1.4.2
go: downloading dario.cat/mergo v1.0.0
go: downloading github.com/ProtonMail/go-crypto v1.0.0
go: downloading github.com/go-git/go-billy/v5 v5.5.0
go: downloading github.com/emirpasic/gods v1.18.1
go: downloading github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b
go: downloading cloud.google.com/go/monitoring v1.24.2
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0
go: downloading go.opentelemetry.io/otel/metric v1.45.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0
go: downloading github.com/go-logr/logr v1.4.4
go: downloading cloud.google.com/go/auth/oauth2adapt v0.2.8
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0
go: downloading github.com/pelletier/go-toml/v2 v2.2.1
go: downloading github.com/ugorji/go/codec v1.2.12
go: downloading github.com/bytedance/sonic v1.11.6
go: downloading github.com/goccy/go-json v0.10.5
go: downloading github.com/json-iterator/go v1.1.12
go: downloading github.com/google/s2a-go v0.1.9
go: downloading github.com/99designs/keyring v1.2.2
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0
go: downloading github.com/BurntSushi/toml v1.4.0
go: downloading github.com/apache/arrow-go/v18 v18.4.0
go: downloading github.com/aws/aws-sdk-go-v2 v1.38.1
go: downloading github.com/aws/aws-sdk-go-v2/config v1.27.11
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.17.11
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1
go: downloading github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15
go: downloading github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.28.6
go: downloading github.com/aws/smithy-go v1.22.5
go: downloading github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8
go: downloading github.com/KyleBanks/depth v1.2.1
go: downloading github.com/go-openapi/spec v0.20.4
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/jackc/puddle/v2 v2.2.1
go: downloading github.com/pjbgf/sha1cd v0.3.0
go: downloading github.com/cyphar/filepath-securejoin v0.2.4
go: downloading github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
go: downloading github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
go: downloading golang.org/x/time v0.15.0
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.17
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.37.0
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.2
go: downloading github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4
go: downloading github.com/danieljoos/wincred v1.2.2
go: downloading github.com/dvsekhvalnov/jose2go v1.7.0
go: downloading github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2
go: downloading github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c
go: downloading github.com/mtibben/percent v0.2.1
go: downloading golang.org/x/term v0.45.0
go: downloading golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
go: downloading github.com/google/flatbuffers v25.2.10+incompatible
go: downloading github.com/klauspost/compress v1.18.0
go: downloading github.com/pierrec/lz4/v4 v4.1.22
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.20.5
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7
go: downloading github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2
go: downloading github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5
go: downloading github.com/jmespath/go-jmespath v0.4.0
go: downloading github.com/go-openapi/jsonpointer v0.19.5
go: downloading github.com/go-openapi/jsonreference v0.19.6
go: downloading github.com/go-openapi/swag v0.19.15
go: downloading github.com/cloudflare/circl v1.3.7
go: downloading gopkg.in/warnings.v0 v0.1.2
go: downloading github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
go: downloading github.com/kevinburke/ssh_config v1.2.0
go: downloading github.com/skeema/knownhosts v1.2.2
go: downloading github.com/xanzy/ssh-agent v0.3.3
go: downloading github.com/spiffe/go-spiffe/v2 v2.7.0
go: downloading github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
go: downloading github.com/envoyproxy/protoc-gen-validate v1.3.3
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
go: downloading github.com/cloudwego/base64x v0.1.4
go: downloading golang.org/x/arch v0.7.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2
go: downloading golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959
go: downloading github.com/zeebo/xxh3 v1.0.2
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5
go: downloading github.com/PuerkitoBio/purell v1.1.1
go: downloading github.com/mailru/easyjson v0.7.7
go: downloading github.com/Microsoft/go-winio v0.6.2
go: downloading github.com/go-jose/go-jose/v4 v4.1.4
go: downloading cel.dev/expr v0.25.2
go: downloading github.com/bytedance/sonic/loader v0.1.1
go: downloading github.com/twitchyliquid64/golang-asm v0.15.1
go: downloading github.com/klauspost/cpuid/v2 v2.2.11
go: downloading github.com/apache/thrift v0.22.0
go: downloading github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578
go: downloading github.com/josharian/intern v1.0.0
go: downloading github.com/klauspost/asmfmt v1.3.2
go: downloading github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8
go: downloading github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3
go: downloading github.com/cloudwego/iasm v0.2.0
go: downloading github.com/andybalholm/brotli v1.2.0
go: downloading github.com/golang/snappy v1.0.0
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/context: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/context
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/dal: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/dal
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/log: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/log
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/plugin: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/plugin
go: github.com/apache/incubator-devlake/helpers/pluginhelper/api tested by
	github.com/apache/incubator-devlake/helpers/pluginhelper/api.test imports
	github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api: cannot find module providing package github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api
go: module github.com/aws/aws-sdk-go is deprecated: aws-sdk-go is deprecated. Use aws-sdk-go-v2.

[snyk-io]

⛔ Snyk checks have failed. 7 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (7)
⛔	Open Source Security	0	7	0	0	7 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:25 PM UTC · Completed 5:31 PM UTC
Commit: 701e62a · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:54 PM UTC · Completed 5:00 PM UTC
Commit: 701e62a · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:26 AM UTC · Completed 2:32 AM UTC

Commit: 1e64447 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:26 AM UTC · Completed 2:32 AM UTC

Commit: 9ee3c25 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:21 AM UTC · Completed 2:27 AM UTC

Commit: 9ee3c25 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.02

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:21 AM UTC · Completed 5:30 AM UTC

Commit: 9ee3c25 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.70

[fullsend-ai-review]

Risk Assessment: low (1/5)

Details

Bot-authored single-file indirect dependency digest bump (go.mod, 2 lines) with zero protected/security-sensitive path touches and minimal blast radius; Tier 1 and Tier 2 signals unchanged from prior assessment, composite rounds to 1 (low).

Previous run

Risk Assessment: low (1/5)

Details

Bot-authored single-file indirect dependency digest bump (go.mod, 2 lines) with zero protected/security-sensitive path touches and minimal blast radius; Tier 1 and Tier 2 signals unchanged from prior assessment, composite rounds to 1 (low).

Previous run (2)

Risk Assessment: low (1/5)

Details

Bot-authored single-file indirect dependency digest bump (go.mod, 2 lines) with zero protected/security-sensitive path touches and minimal blast radius; Tier 1 and Tier 2 signals unchanged from prior assessment, composite rounds to 1 (low).

Previous run (3)

Risk Assessment: low (1/5)

Details

Single-file bot-authored indirect dependency digest update (go.mod, 2 lines) with zero protected/security-sensitive path touches and minimal blast radius; Tier 2 shows no recent churn and 91-day code age but the composite (0.62x1.25 + 0.38x1.43 = 1.32) rounds to 1, consistent with the prior score of 1 (low).

Previous run (4)

Risk Assessment: low (1/5)

Details

Single-file bot-authored indirect dependency digest update (go.mod, 2 lines) with zero protected/security-sensitive path touches and minimal blast radius; Tier 2 shows mild fix/revert history and 84-day code age but the composite (0.62x1.25 + 0.38x1.71 = 1.43) rounds to 1, consistent with the prior score of 1 (low).

Previous run (5)

Risk Assessment: low (1/5)

Details

Single-file bot-authored indirect dependency digest update (go.mod, 2 lines) with zero protected/security-sensitive path touches and minimal blast radius; Tier 2 mildly elevated only by routine fix-commit history on the deps file, yielding a composite of ~1.4 that rounds to 1 (low).

Previous run (6)

Risk Assessment: moderate (2/5)

Details

Bot-authored indirect Go dependency digest bump on a single file with 2 lines changed scores moderate (2) because the dependency file change and zero test-file ratio inflate Tier 1 above baseline, though both are expected for a routine automated go.mod digest update with minimal blast radius, no protected paths, and stable git history.

Previous run (7)

Risk Assessment: low (1/5)

Details

Bot-authored single-file dependency digest update with minimal changes (2 lines) and no security or protected path modifications; Tier 1 signals unchanged from prior assessment and Tier 2 fix-commit history in go.mod is expected for a frequently bot-bumped dependency file, providing no articulable basis to raise the score.

Previous run (8)

Risk Assessment: low (1/5)

Details

Bot-authored single-file dependency update with minimal changes (2 lines) and no security or protected path modifications.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:18 AM UTC · Completed 1:26 AM UTC

Commit: 9ee3c25 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.41

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:21 AM UTC · Completed 5:29 AM UTC

Commit: d9133a6 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.50

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:28 AM UTC · Completed 1:36 AM UTC

Commit: 0f055a8 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.47

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:28 AM UTC · Completed 1:42 AM UTC

Commit: 3a8f846 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.71

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:33 AM UTC · Completed 1:45 AM UTC

Commit: 5a99fad · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.70

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:43 AM UTC · Completed 1:53 AM UTC

Commit: c186420 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.25

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:01 AM UTC · Completed 2:15 AM UTC

Commit: 8962fa4 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.80

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:04 AM UTC · Completed 4:14 AM UTC

Commit: 1d95204 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.22

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] api-contract

go.mod updates google.golang.org/genproto from v0.0.0-20250303144028-a0af3efb3deb to v0.0.0-20261026165753-2ffab32bce7e, but the corresponding backend/go.sum file is not included in the PR. The base branch go.sum contains checksums only for the old version (a0af3efb3deb) and has no entries for the new version (2ffab32bce7e). Without updated go.sum entries, go build, go test, and go mod verify will fail with a checksum mismatch or missing-checksum error, breaking the backend module build.

Suggested fix: Run cd backend && go mod tidy to regenerate go.sum with the correct checksums for the new genproto version, then include the updated go.sum in this PR.