chore(deps): update github.com/planetscale/vtprotobuf digest to 8ae5a48

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
github.com/planetscale/vtprotobuf	indirect	digest	0393e58 → 8ae5a48

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:18 PM UTC · Completed 9:21 PM UTC
Commit: 37b10e4 · View workflow run →

[fullsend-ai-review]

Review

Findings

Critical

• [dependency-version-format] backend/go.mod:178 — The go.mod entry for github.com/planetscale/vtprotobuf uses a bare commit hash (8ae5a48058df) instead of a valid Go module version. Go modules require all versions to follow semver (vX.Y.Z) or the pseudo-version format (vX.Y.Z-YYYYMMDDHHMMSS-abcdefabcdef). The bare hash is not parseable by any Go tooling and will cause immediate build failures: go mod tidy, go build, and go test will all error out with a version-parsing failure.
  Remediation: Run go get github.com/planetscale/vtprotobuf@8ae5a48058df to let Go resolve the commit hash into a proper pseudo-version string, then commit the corrected go.mod and go.sum. Alternatively, run go mod tidy which will also fix the format.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review of PR #136 — chore(deps): update github.com/planetscale/vtprotobuf digest to 8ae5a48

Verdict: Request Changes

Summary

This PR (from red-hat-konflux[bot] / MintMaker) attempts to bump the indirect dependency github.com/planetscale/vtprotobuf to a new commit digest. However, the go.mod change introduces invalid Go module version syntax that will break all Go toolchain operations (go build, go mod tidy, go test, etc.).

Findings

1. 🚨 Invalid Go module version syntax (high — correctness)

File: backend/go.mod, line 178

The version was changed from:

github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect

to:

github.com/planetscale/vtprotobuf 8ae5a48058df // indirect

The new value 8ae5a48058df is a bare commit hash. Go module versions must follow semver with a v prefix — either a tagged version (e.g. v0.7.0) or a pseudo-version (e.g. v0.6.1-0.20260718000000-8ae5a48058df). A bare hash is not valid go.mod syntax and will cause the Go toolchain to reject the file with a parse error.

Remediation: Regenerate the go.mod entry using go get github.com/planetscale/vtprotobuf@8ae5a48058df which will produce the correct pseudo-version format, then run go mod tidy.

2. ⚠ Missing go.sum update (medium — correctness)

File: backend/go.sum

The PR only modifies backend/go.mod but does not update backend/go.sum. When a dependency version changes, the corresponding checksum entries in go.sum must also be updated. Without this, go mod verify will fail and builds with checksum verification enabled will be rejected.

Remediation: Run go mod tidy from backend/ to regenerate both go.mod and go.sum with correct entries.

Recommendation

This PR should not be merged in its current state. The MintMaker/Renovate bot appears to have produced a malformed version entry. The fix is to run go get github.com/planetscale/vtprotobuf@8ae5a48058df && go mod tidy from the backend/ directory to generate the proper pseudo-version and update checksums.

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/go.sum

Command failed: go get -t ./...
go: downloading github.com/stretchr/testify v1.11.1
go: downloading golang.org/x/oauth2 v0.34.0
go: downloading golang.org/x/sync v0.19.0
go: downloading github.com/rogpeppe/go-internal v1.14.1
go: downloading golang.org/x/sys v0.39.0
go: downloading golang.org/x/crypto v0.46.0
go: downloading golang.org/x/text v0.32.0
go: downloading cloud.google.com/go/compute/metadata v0.9.0
go: downloading go.opentelemetry.io/contrib/detectors/gcp v1.39.0
go: downloading go.opentelemetry.io/otel v1.39.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.39.0
go: downloading go.opentelemetry.io/otel/sdk v1.39.0
go: downloading go.opentelemetry.io/otel/trace v1.39.0
go: downloading google.golang.org/grpc v1.79.3
go: downloading golang.org/x/mod v0.30.0
go: downloading golang.org/x/net v0.48.0
go: downloading golang.org/x/tools v0.39.0
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0
go: downloading go.opentelemetry.io/otel/metric v1.39.0
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.36.0
go: downloading golang.org/x/term v0.38.0
go: downloading github.com/spiffe/go-spiffe/v2 v2.6.0
go: downloading github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20260702190614-8ae5a48058df
go: downloading golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54
go: downloading github.com/go-jose/go-jose/v4 v4.1.3
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/context: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/context
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/dal: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/dal
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/log: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/log
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/plugin: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/plugin
go: github.com/apache/incubator-devlake/helpers/pluginhelper/api tested by
	github.com/apache/incubator-devlake/helpers/pluginhelper/api.test imports
	github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api: cannot find module providing package github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api
go: module github.com/aws/aws-sdk-go is deprecated: aws-sdk-go is deprecated. Use aws-sdk-go-v2.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:53 PM UTC · Completed 5:01 PM UTC
Commit: 701e62a · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[critical] dependency-version-format

The go.mod entry for github.com/planetscale/vtprotobuf uses a bare commit hash (8ae5a48058df) instead of a valid Go module version. Go modules require all versions to follow semver (vX.Y.Z) or the pseudo-version format (vX.Y.Z-YYYYMMDDHHMMSS-abcdefabcdef). The bare hash is not parseable by any Go tooling and will cause immediate build failures: go mod tidy, go build, and go test will all error out with a version-parsing failure.

Suggested fix: Run go get github.com/planetscale/vtprotobuf@8ae5a48058df to let Go resolve the commit hash into a proper pseudo-version string, then commit the corrected go.mod and go.sum. Alternatively, run go mod tidy which will also fix the format.