chore(deps): bump Go and in-toto dependencies#161
Merged
Conversation
- bump Go version to 1.26.3 in main and tools modules - upgrade github.com/in-toto/in-toto-golang to v0.11.0 - refresh go.sum and vendored in-toto sources for compatibility
alaudabot
reviewed
May 9, 2026
alaudabot
left a comment
alaudabot
left a comment
There was a problem hiding this comment.
Review Summary
This PR bumps Go version to 1.26.3 (including security fixes) and upgrades in-toto-golang to v0.11.0. The changes are primarily dependency updates with vendored source refresh.
Critical Issues: 0
Warnings: 1 (see inline comment)
Suggestions: 0
The Go upgrade includes 11 security fixes. The in-toto-golang upgrade includes type safety improvements. See inline comment for a breaking change to note.
| // format is defined by builder.id; by default it is treated as opaque and | ||
| // case-sensitive. The value SHOULD be globally unique. | ||
| InvocationID string `json:"invocationID,omitempty"` | ||
| InvocationID string `json:"invocationId,omitempty"` |
There was a problem hiding this comment.
Warning (breaking-change): The JSON field name changed from invocationID to invocationId (camelCase). This is a breaking change in SLSA provenance v1 JSON serialization. If this project generates SLSA attestations, consumers expecting the old field name will fail to parse. Please verify this change is compatible with your SLSA verification pipeline.
SummaryThis PR bumps Go version to 1.26.3 (including security fixes) and upgrades in-toto-golang to v0.11.0. The changes are primarily dependency updates with vendored source refresh. The Go upgrade includes 11 security fixes. The in-toto-golang upgrade includes type safety improvements and a JSON field naming change. Review Statistics
Critical IssuesNo critical issues found. Warnings
SuggestionsNo suggestions. Positive Feedback
|
🤖 AI Code Review
SummaryThis PR bumps Go version to 1.26.3 (including security fixes) and upgrades in-toto-golang to v0.11.0. The changes are primarily dependency updates with vendored source refresh. The Go upgrade includes 11 security fixes. The in-toto-golang upgrade includes type safety improvements and a JSON field naming change. Review Statistics
Critical IssuesNo critical issues found. Warnings
SuggestionsNo suggestions. Positive Feedback
ℹ️ About this reviewThis review was automatically generated using the
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Auto-generated by
tektoncd-run-skills.sh. Every skill below ran inchanges-only mode and all modifications were combined into a single commit
on top of origin/alauda-v0.41.1.
Commit message
chore(deps): bump Go and in-toto dependenciesSkills executed (in order)
devops-refresh-containerfile-digests— changed(49s)devops-sync-alauda-github-releases— changed(55s)devops-upgrade-go— changed(324s)devops-fix-go-vulns— changed(223s)Changed files
Test plan