chore(deps): upgrade in-toto-golang and refresh vendored sources#160
Merged
Conversation
- bump github.com/in-toto/in-toto-golang from v0.9.0 to v0.11.0 - update Go toolchain patch version to 1.26.3 in module and image build args - refresh vendored in-toto files and checksums to match the dependency upgrade
alaudabot
reviewed
May 9, 2026
alaudabot
left a comment
alaudabot
left a comment
There was a problem hiding this comment.
PR Review Summary
Reviewed by alaudabot. This is a clean dependency upgrade PR with no blocking issues.
Verdict: PR is good to go.
Files Reviewed
15 files changed (+281/-276), primarily vendored sources.
Findings
- Critical Issues: 0
- Warnings: 0
- Suggestions: 1
Suggestion
vendor/modules.txt:1018— The vendoredmodules.txtnow declaresgo 1.24.0as the Go version forin-toto/in-toto-golang, while the module declaresgo 1.26.3. This is cosmetic (the localgo.modgoverns the build) but indicates the vendor was refreshed with a newer Go toolchain.
Positive Feedback
- Go version consistency across
go.modandDockerfile(both 1.26.2 → 1.26.3) - Build compiles successfully with updated dependencies
- Dependency upgrade follows a clean, standard pattern
- Vulnerability fixes from upstream (
devops-fix-go-vulns) are included
| github.com/in-toto/attestation/go/v1 | ||
| # github.com/in-toto/in-toto-golang v0.9.0 | ||
| ## explicit; go 1.20 | ||
| # github.com/in-toto/in-toto-golang v0.11.0 |
There was a problem hiding this comment.
Info (style/consistency): The vendored modules.txt shows go 1.24.0 for in-toto-golang v0.11.0, while the main go.mod declares go 1.26.3. This is cosmetic and doesn't break the build, but it's worth noting the vendor was created with a newer Go toolchain than the project minimum.
🤖 AI Code Review
SummaryThis PR upgrades Review Statistics
Critical IssuesNone. WarningsNone. Suggestions
Positive Feedback
ℹ️ About this reviewThis review was automatically generated using the
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Auto-generated by
tektoncd-run-skills.sh. Every skill below ran inchanges-only mode and all modifications were combined into a single commit
on top of origin/alauda-v0.34.0.
Commit message
chore(deps): upgrade in-toto-golang and refresh vendored sourcesSkills executed (in order)
devops-refresh-containerfile-digests— noop(30s)devops-sync-alauda-github-releases— noop(42s)devops-upgrade-go— changed(249s)devops-fix-go-vulns— changed(218s)Changed files
Test plan