You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: acceptance/go.sum
Command failed: go get -t ./...
go: module github.com/conforma/cli@v0.9.46 requires go >= 1.25.8; switching to go1.25.11
go: downloading github.com/google/go-containerregistry v0.21.5
go: downloading github.com/cespare/xxhash v1.1.0
go: downloading github.com/sigstore/timestamp-authority v1.2.2
go: downloading github.com/vektah/gqlparser v1.2.0
go: downloading github.com/containerd/containerd v1.7.27
go: downloading github.com/go-chi/chi v4.1.2+incompatible
go: downloading github.com/dgraph-io/ristretto v0.1.1
go: github.com/muhammadmuzzammil1998/jsonc@v1.0.0 used for two different module paths (github.com/muhammadmuzzammil1998/jsonc and muzzammil.xyz/jsonc)
File name: go.sum
Command failed: go get -t ./...
go: module github.com/conforma/cli@v0.9.46 requires go >= 1.25.8; switching to go1.25.11
go: module github.com/styrainc/regal@v0.41.1 requires go >= 1.26; switching to go1.26.4
go: github.com/styrainc/regal@v0.41.1: parsing go.mod:
module declares its path as: github.com/open-policy-agent/regal
but was required as: github.com/styrainc/regal
[API contract violation]go.mod — The root go.sum and acceptance/go.sum are not updated in this PR despite version changes in their respective go.mod files. The docs/go.sum is correctly updated, but the root module (which bumps 6 dependencies) and the acceptance module (which bumps 2 dependencies) are missing their go.sum updates. Without updated checksums, go build and go mod verify will fail for these modules. Remediation: Run go mod tidy in the root directory and in the acceptance/ directory to regenerate the go.sum files, and include those changes in this PR.
Low
[edge-case]go.mod — Several dependencies have large version jumps within the 0.x semver range (conforma/cli v0.7→v0.9, conftest v0.55→v0.68, regal v0.29→v0.41) where backward compatibility is not guaranteed. CI should validate that no breaking changes affect this project's usage of these tools.
Info
[sub-agent-failure] — The style-conventions sub-agent did not return findings: model unavailable. This dimension would have early-exited for a dependency version bump PR regardless.
Previous run
Review
Findings
Info
[scope-inferred]go.mod — No linked issue, but authorization is implicit: this is a mechanical Renovate bot dependency version bump. The requires-manual-review label is appropriately set. Notable version jumps include conforma/cli v0.7.x → v0.9.44 and conftest v0.55.0 → v0.68.2 — human reviewers should verify compatibility with the release-v0.7 branch.
[sub-agent-failure]N/A — The intent-coherence and style-conventions sub-agents did not return findings: model claude-sonnet-4-5@20250929 unavailable on this deployment. These are sonnet-tier dimensions; the correctness (opus) sub-agent completed successfully with no findings.
Previous run (2)
Review
Findings
Medium
[api-contract]go.mod — The PR updates go.mod in the root and acceptance/ directories but does not include corresponding go.sum changes. The root go.sum and acceptance/go.sum both exist in the repository but do not contain checksums for the newly required versions (e.g., conforma/cli v0.9.43). Without updated go.sum files, builds using -mod=readonly or go mod verify will fail. Only docs/go.sum is updated in this PR.
Remediation: Run go mod tidy in both the root directory and acceptance/ directory, then include the updated go.sum files in the PR.
Info
[sub-agent-failure]N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 unavailable on deployment.
[sub-agent-failure]N/A — The intent-coherence sub-agent did not return findings: model claude-sonnet-4-5@20250929 unavailable on deployment.
Previous run (3)
Review
Findings
Info
[api-contract]acceptance/go.mod:5 — The conforma/cli dependency jumps from v0.7.95 to v0.9.42 (two minor versions for a pre-1.0 module). However, the main branch already uses v0.9.2 with the same import paths (cmd/validate), confirming API compatibility. CI should validate the specific patch version.
[api-contract]go.mod:10 — Several significant version jumps: styrainc/regal v0.29.2→v0.41.1, conftest v0.55.0→v0.68.2, tektoncd/cli v0.39.1→v0.45.0. These are used as tooling dependencies (blank imports in tools.go and direct usage in regal.go). The main branch uses even newer versions of these packages, indicating compatibility. CI compilation will confirm.
[api-contract]docs/go.mod:5 — OPA v0.68.0→v0.70.0 with transitive switch from yaml.v2 to yaml.v3. The yaml.v3 dependency is indirect only (driven by OPA); no direct code imports either yaml package in the docs module.
[sub-agent-failure]N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 unavailable on deployment. Given this is a dependency-only change with no code style to evaluate, the gap has no material impact.
Previous run (4)
Review
Findings
High
[api-contract]go.mod, acceptance/go.mod — The root go.mod bumps 6 direct dependencies and acceptance/go.mod bumps 2, but neither go.sum nor acceptance/go.sum are included in the changed file set. The docs/go.sum is correctly updated, making this omission inconsistent. Without updated checksums, go mod verify and builds will fail for the root and acceptance modules. Remediation: Run go mod tidy in both the root and acceptance/ directories and include the updated go.sum files in the PR.
Low
[edge-case]go.mod — Several version bumps cross multiple minor versions for pre-1.0 modules (conforma/cli v0.7→v0.9, conftest v0.55→v0.68, regal v0.29→v0.41, tektoncd/cli v0.39→v0.45). For pre-1.0 Go modules, minor version bumps can contain breaking changes. Verify CI passes with all tests green before merging.
[edge-case]docs/go.mod — The indirect dependency switches from gopkg.in/yaml.v2 to gopkg.in/yaml.v3, driven by the OPA v0.68→v0.70 upgrade. This is a safe transitive change — no code in docs/ directly imports yaml, and docs/go.sum is correctly updated.
Info
[sub-agent-failure]N/A — The style-conventions sub-agent did not return findings: model unavailable. This dimension is non-blocking for a go.mod-only dependency update.
Previous run (5)
Review
Findings
Low
[api-contract]go.mod — Root go.sum was not updated alongside go.mod direct dependency bumps (6 dependencies changed). The go.sum SHA is identical on the base branch and the PR head, meaning go mod tidy was not run for the root module. If CI runs with -mod=readonly, the build will fail due to missing checksums for the new dependency versions.
[api-contract]acceptance/go.mod — acceptance/go.sum was not updated alongside acceptance/go.mod changes (conforma/cli v0.7.95→v0.9.40, godog v0.13.0→v0.15.1). Same root cause — go mod tidy was not run for the acceptance module.
Info
[sub-agent-failure]N/A — The style-conventions sub-agent did not return findings: model unavailable. This dimension was not evaluated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.7.109→v0.9.46v0.7.95→v0.9.46v0.13.0→v0.15.1v1.1.1→v1.2.0v0.55.0→v0.68.2v0.68.0→v0.70.0v0.29.2→v0.41.1v0.39.1→v0.45.0v1.2.3→v1.3.2Release Notes
conforma/cli (github.com/conforma/cli)
v0.9.46Compare Source
v0.9.44Compare Source
v0.9.43Compare Source
v0.9.42Compare Source
v0.9.41Compare Source
v0.9.40Compare Source
v0.9.39Compare Source
v0.9.38Compare Source
v0.9.37Compare Source
v0.9.36Compare Source
v0.9.35Compare Source
v0.9.34Compare Source
v0.9.33Compare Source
v0.9.32Compare Source
v0.9.31Compare Source
v0.9.30Compare Source
v0.9.29Compare Source
v0.9.27Compare Source
v0.9.26Compare Source
v0.9.25Compare Source
v0.9.24Compare Source
v0.9.23Compare Source
v0.9.22Compare Source
v0.9.19Compare Source
v0.9.17Compare Source
v0.9.16Compare Source
v0.9.14Compare Source
v0.9.13Compare Source
v0.9.9Compare Source
v0.9.2Compare Source
v0.9.1Compare Source
v0.8.129Compare Source
v0.8.123Compare Source
v0.8.122Compare Source
v0.8.120Compare Source
v0.8.108Compare Source
v0.8.107Compare Source
v0.8.105Compare Source
v0.8.102Compare Source
v0.8.100Compare Source
v0.8.95Compare Source
v0.8.92Compare Source
v0.8.91Compare Source
v0.8.90Compare Source
v0.8.89Compare Source
v0.8.88Compare Source
v0.8.87Compare Source
v0.8.86Compare Source
v0.8.83Compare Source
v0.8.80Compare Source
v0.8.79Compare Source
v0.8.77Compare Source
v0.8.76Compare Source
v0.8.75Compare Source
v0.8.74Compare Source
v0.8.73Compare Source
v0.8.48Compare Source
v0.8.47Compare Source
v0.8.45Compare Source
v0.8.44Compare Source
v0.8.43Compare Source
v0.8.42Compare Source
v0.8.39Compare Source
v0.8.36Compare Source
v0.8.35Compare Source
v0.8.34Compare Source
v0.8.33Compare Source
v0.8.32Compare Source
v0.8.31Compare Source
v0.8.29Compare Source
v0.8.28Compare Source
v0.8.25Compare Source
v0.8.23Compare Source
v0.8.22Compare Source
v0.8.21Compare Source
v0.8.18Compare Source
v0.8.13Compare Source
v0.8.12Compare Source
v0.8.10Compare Source
v0.8.9Compare Source
v0.8.7Compare Source
v0.8.6Compare Source
v0.8.4Compare Source
v0.8.2Compare Source
v0.7.151Compare Source
v0.7.150Compare Source
v0.7.148Compare Source
v0.7.143Compare Source
v0.7.141Compare Source
v0.7.140Compare Source
v0.7.136Compare Source
v0.7.135Compare Source
v0.7.134Compare Source
v0.7.132Compare Source
v0.7.131Compare Source
v0.7.130Compare Source
v0.7.129Compare Source
v0.7.128Compare Source
v0.7.127Compare Source
v0.7.123Compare Source
v0.7.121Compare Source
v0.7.118Compare Source
v0.7.117Compare Source
v0.7.114Compare Source
v0.7.113Compare Source
v0.7.110Compare Source
cucumber/godog (github.com/cucumber/godog)
v0.15.1Compare Source
Added
Changed
::set-output- (681 - nodeg)Fixed
context.Context(679 - tigh-latte)v0.15.0Compare Source
Added
Changed
Closemethod and associatedio.Writerchanged toio.WriteCloser.v0.14.1Compare Source
Added
Fixed
v0.14.0Compare Source
Added
Fixed
Changed
google/addlicense (github.com/google/addlicense)
v1.2.0Compare Source
This is the first full release after a period of dormancy for the project. Support for several file types has been added, plus some internal cleanup.
What's Changed
.graphqlsupport by @SleepySquash in #111New Contributors
Full Changelog: google/addlicense@v1.1.1...v1.2.0
open-policy-agent/conftest (github.com/open-policy-agent/conftest)
v0.68.2Compare Source
Changelog
OPA Changes
36f23bf: build(deps): bump github.com/open-policy-agent/opa from 1.15.1 to 1.15.2 (#1311) (@dependabot[bot])Other Changes
479de13: build(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#1307) (@dependabot[bot])v0.68.1Compare Source
Changelog
Bug Fixes
2631477: fix(push): Use Rego v1 by default (#1290) (@jalseth)v0.68.0Compare Source
Changelog
New Features
a604f55: feat(parser): Add nginx parser (#1289) (@jalseth)Bug Fixes
487a2e1: fix: Skip extensionless files that are not recognized types (#1302) (@ricardbejarano)OPA Changes
472e4e3: build(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.15.1 (#1303) (@dependabot[bot])Other Changes
6d521ef: build(deps): bump github.com/google/go-jsonnet from 0.21.0 to 0.22.0 (#1299) (@dependabot[bot])2d5f1c2: build(deps): bump github.com/moby/buildkit from 0.28.0 to 0.29.0 (#1306) (@dependabot[bot])v0.67.1Compare Source
Changelog
Bug Fixes
9cef5a2: fix(releasing): Ensure GoReleaser creates a tar for linux_amd64 (#1294) (@jalseth)Other Changes
8bc9477: build(deps): bump actions/setup-go from 6.0.0 to 6.3.0 (#1278) (@dependabot[bot])7655171: build(deps): bump docker/build-push-action from 6.19.2 to 7.0.0 (#1284) (@dependabot[bot])35ab0ca: build(deps): bump docker/login-action from 3.6.0 to 4.0.0 (#1283) (@dependabot[bot])94e5286: build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 (#1275) (@dependabot[bot])45a3835: ci: Update Nix devshell to use go-overlay (#1287) (@jalseth)v0.67.0Compare Source
Changelog
Bug Fixes
69f41ed: fix(plugin): Handle spaces in the plugin command path (#1242) (@jalseth)OPA Changes
59cb419: build(deps): bump github.com/open-policy-agent/opa from 1.12.1 to 1.13.1 (#1262) (@dependabot[bot])507345f: build(deps): bump github.com/open-policy-agent/opa from 1.13.1 to 1.13.2 (#1274) (@dependabot[bot])69b7329: build(deps): bump github.com/open-policy-agent/opa from 1.13.2 to 1.14.1 (#1282) (@dependabot[bot])Other Changes
8ec8ba0: build(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#1230) (@dependabot[bot])fb1d20e: build(deps): bump alpine from 3.23.2 to 3.23.3 (#1264) (@dependabot[bot])84ee4f1: build(deps): bump bats-core/bats-action from 3.0.1 to 4.0.0 (#1270) (@dependabot[bot])06f26a6: build(deps): bump cuelang.org/go from 0.15.1 to 0.15.3 (#1244) (@dependabot[bot])d01f783: build(deps): bump cuelang.org/go from 0.15.3 to 0.15.4 (#1259) (@dependabot[bot])b7f9627: build(deps): bump cuelang.org/go from 0.15.4 to 0.16.0 (#1279) (@dependabot[bot])3e4cf98: build(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#1273) (@dependabot[bot])b7060d3: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.3 to 0.10.0 (#1265) (@dependabot[bot])e130513: build(deps): bump github.com/hashicorp/go-getter from 1.8.3 to 1.8.4 (#1245) (@dependabot[bot])e5afd3f: build(deps): bump github.com/hashicorp/go-getter from 1.8.4 to 1.8.5 (#1285) (@dependabot[bot])d6f5fb2: build(deps): bump github.com/moby/buildkit from 0.26.3 to 0.27.1 (#1260) (@dependabot[bot])c1ba806: build(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.0 (#1280) (@dependabot[bot])fc57996: build(deps): bump github.com/spdx/tools-golang from 0.5.5 to 0.5.6 (#1243) (@dependabot[bot])95d756f: build(deps): bump github.com/spdx/tools-golang from 0.5.6 to 0.5.7 (#1251) (@dependabot[bot])a59b8bd: build(deps): bump golang from 1.25.5-alpine to 1.25.6-alpine (#1256) (@dependabot[bot])bde1457: build(deps): bump golang from 1.25.6-alpine to 1.26.1-alpine (#1281) (@dependabot[bot])b2e58f0: build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.2.0 (#1231) (@dependabot[bot])b1e9f30: ci: Update Dependabot config (#1267) (@jalseth)bf63002: ci: Update setup-go to use Go version from go.mod (#1268) (@jalseth)v0.66.0Compare Source
Changelog
OPA Changes
08529c7: build(deps): bump github.com/open-policy-agent/opa from 1.11.0 to 1.12.1 (#1240) (@dependabot[bot])Other Changes
10434c1: build(deps): bump actions/setup-python from 6.0.0 to 6.1.0 (#1225) (@dependabot[bot])25bee5d: build(deps): bump alpine from 3.22.2 to 3.23.0 (#1229) (@dependabot[bot])6cafc0f: build(deps): bump github.com/BurntSushi/toml from 1.5.0 to 1.6.0 (#1238) (@dependabot[bot])f6b8fa9: build(deps): bump github.com/moby/buildkit from 0.26.2 to 0.26.3 (#1235) (@dependabot[bot])233776f: build(deps): bump golang from 1.25.4-alpine to 1.25.5-alpine (#1228) (@dependabot[bot])7a86f94: chore: Remove dependency on github.com/pkg/errors (#1233) (@jalseth)5a394b8: ci(golangci-lint): Disable revive skip-package-name-collision-with-go-std (#1232) (@jalseth)v0.65.0Compare Source
Changelog
New Features
7de1f99: feat: Add location to SARIF output (#1207) (@jalseth)Bug Fixes
94bb769: fix(build): Include Git version when using 'make build' (#1218) (@jalseth)ff4e456: fix(sarif): Include conftest version number (#1206) (@jalseth)OPA Changes
8c4cfa6: build(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.11.0 (#1224) (@dependabot[bot])Other Changes
3dab980: build(deps): bump cuelang.org/go from 0.15.0 to 0.15.1 (#1217) (@dependabot[bot])cfa85ca: build(deps): bump github.com/moby/buildkit from 0.25.2 to 0.26.2 (#1216) (@dependabot[bot])dd7e3bc: build(deps): bump golang from 1.25.3-alpine to 1.25.4-alpine (#1210) (@dependabot[bot])bbbb04c: chore: Include goreleaser in Nix devshell (#1219) (@jalseth)ac3146f: ci: Pin GitHub Actions to the Git SHA using ratchet (#1204) (@jalseth)v0.64.0Compare Source
Changelog
New Features
00b02b2: feat: Include location in the result output (#1196) (@jalseth)ee91078: feat: Refactor GitHub outputter to support locations from Rego policy (#1197) (@jalseth)d359466: feat: add conftest-fmt and conftest-pull pre-commit hooks ([#&Bump github.com/open-policy-agent/conftest from 0.46.0 to 0.47.0 #820Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.