Update module gopkg.in/evanphx/json-patch.v4 to v5#319
Update module gopkg.in/evanphx/json-patch.v4 to v5#319red-hat-konflux[bot] wants to merge 1 commit into
Conversation
red-hat-konflux
Bot
added
approved
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe indirect JSON Patch dependency in ChangesJSON Patch Dependency
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
go.mod (1)
97-97: 🗄️ Data Integrity & Integration | 🔵 Trivial | 💤 Low valueDrop the unused
gopkg.in/evanphx/json-patch.v5pin
go.mod:97only adds noise here; the module graph usesgithub.com/evanphx/json-patch/v5throughsigs.k8s.io/controller-runtime, so this indirect entry can be removed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 97, Remove the unused gopkg.in/evanphx/json-patch.v5 v5.9.11 indirect requirement from go.mod, while preserving the github.com/evanphx/json-patch/v5 dependency used through sigs.k8s.io/controller-runtime.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@go.mod`:
- Line 97: Remove the unused gopkg.in/evanphx/json-patch.v5 v5.9.11 indirect
requirement from go.mod, while preserving the github.com/evanphx/json-patch/v5
dependency used through sigs.k8s.io/controller-runtime.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 64bd5fd9-b0d6-472f-a970-61279915a3c7
📒 Files selected for processing (1)
go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
|
/hold Revision 903d775 was retested 3 times: holding |
openshift-ci
Bot
added
the
do-not-merge/hold
903d775 to
10bc1f5
Compare
|
New changes are detected. LGTM label has been removed. |
10bc1f5 to
6e863c4
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 97: Add the missing checksum entry for gopkg.in/evanphx/json-patch.v5
v5.9.11 to go.sum, matching the dependency version declared in go.mod.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 52820720-f270-4cb6-b35d-3a9ec29165eb
📒 Files selected for processing (1)
go.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect | ||
| google.golang.org/grpc v1.82.0 // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect | ||
| gopkg.in/evanphx/json-patch.v5 v5.9.11 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
go mod verify
go list -m all
govulncheck ./...Repository: openshift/lightspeed-agentic-operator
Length of output: 386
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod excerpt =="
nl -ba go.mod | sed -n '88,104p'
echo
echo "== go.sum entries for json-patch =="
rg -n 'evanphx/json-patch|gomodules.xyz/jsonpatch' go.sum || true
echo
echo "== module graph entries =="
go list -m all | rg 'evanphx/json-patch|gomodules.xyz/jsonpatch' || true
echo
echo "== go mod download info =="
go mod download -json gopkg.in/evanphx/json-patch.v5@v5.9.11 2>/dev/null | sed -n '1,80p' || trueRepository: openshift/lightspeed-agentic-operator
Length of output: 236
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== search usages =="
rg -n 'json-patch|jsonpatch' . --glob '!go.sum' --glob '!vendor/**' || trueRepository: openshift/lightspeed-agentic-operator
Length of output: 888
🌐 Web query:
gopkg.in/evanphx/json-patch.v5 v5.9.11 OSV vulnerability
💡 Result:
As of July 17, 2026, there are no security vulnerabilities associated with version v5.9.11 of the package gopkg.in/evanphx/json-patch.v5 (now primarily distributed via github.com/evanphx/json-patch/v5) [1][2][3]. Official vulnerability databases, including the Go Vulnerability Database, do not list any security advisories for version v5.9.11 [1][4][5]. The only prominent historical vulnerability for the evanphx/json-patch library is GO-2021-0076 (CVE-2018-14632), which affected much older versions of the package and was patched in 2018 [4][5][6]. Version v5.9.11, released on January 28, 2025, primarily introduced non-security updates, such as exporting error types and removing dependencies on unmaintained packages [7][8][9][10]. If your security scanning tools are flagging this version, it is likely a false positive or a misidentification of older, unrelated issues [11].
Citations:
- 1: https://deps.dev/go/gopkg.in%2Fevanphx%2Fjson-patch.v5/v5.9.11
- 2: https://pkg.go.dev/github.com/evanphx/json-patch/v5@v5.9.11
- 3: https://pkg.go.dev/github.com/evanphx/json-patch/v5
- 4: https://pkg.go.dev/vuln/GO-2021-0076
- 5: https://go.googlesource.com/vulndb/+/08496651448e/data/reports/GO-2021-0076.yaml
- 6: https://vulert.com/vuln-db/go-github-com-evanphx-json-patch-55557
- 7: evanphx/json-patch@v5.9.0...v5.9.11
- 8: https://github.com/evanphx/json-patch/releases
- 9: https://github.com/evanphx/json-patch/releases/tag/v5.9.11
- 10: evanphx/json-patch@v5.9.10...v5.9.11
- 11: https://advisories.gitlab.com/pkg/golang/github.com/evanphx/json-patch/
🏁 Script executed (no clone):
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json, urllib.request
payload = {
"package": {"ecosystem": "Go", "name": "gopkg.in/evanphx/json-patch.v5"},
"version": "v5.9.11"
}
req = urllib.request.Request(
"https://api.osv.dev/v1/query",
data=json.dumps(payload).encode(),
headers={"Content-Type": "application/json"},
)
with urllib.request.urlopen(req, timeout=20) as resp:
data = json.load(resp)
print(json.dumps(data, indent=2)[:12000])
PY
Length of output: 2720
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod around line 97 =="
sed -n '90,100p' go.mod
echo
echo "== go.sum matches =="
rg -n 'evanphx/json-patch|gomodules.xyz/jsonpatch' go.sum || true
echo
echo "== module metadata =="
go mod download -json gopkg.in/evanphx/json-patch.v5@v5.9.11 | sed -n '1,120p'Repository: openshift/lightspeed-agentic-operator
Length of output: 2323
Add the matching go.sum entry for gopkg.in/evanphx/json-patch.v5 v5.9.11
go.mod pins the module, but go.sum does not yet include its checksum entry.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 97, Add the missing checksum entry for
gopkg.in/evanphx/json-patch.v5 v5.9.11 to go.sum, matching the dependency
version declared in go.mod.
Source: Path instructions
4588a4e to
3e9d9a1
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
3e9d9a1 to
15e4220
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@red-hat-konflux[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
v4.13.0→v5.9.11Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
evanphx/json-patch (gopkg.in/evanphx/json-patch.v4)
v5.9.11Compare Source
What's Changed
Full Changelog: evanphx/json-patch@v5.9.10...v5.9.11
v5.9.10Compare Source
What's Changed
New Contributors
Full Changelog: evanphx/json-patch@v5.9.0...v5.9.10
v5.9.0Compare Source
What's Changed
Full Changelog: evanphx/json-patch@v5.8.1...v5.9.0
v5.8.1: Fix API breakageCompare Source
This PR fixes Operation containing a reference to internal/json and breaking the ability to manually compose one. This restores that ability using a type alias.
Full Changelog: evanphx/json-patch@v5.8.0...v5.8.1
v5.8.0: Blargh Phixs and EmpathyprovementsCompare Source
This release fixes a few stray panics, addresses large number accuracy, and improves performance!
What's Changed
Full Changelog: evanphx/json-patch@v5.7.0...v5.8.0
v5.7.0: The 2023 ReleaseCompare Source
What's Changed
New Contributors
Full Changelog: evanphx/json-patch@v5.6.0...v5.7.0
v5.6.0: Bug fixesCompare Source
What's Changed
New Contributors
Full Changelog: evanphx/json-patch@v5.5.0...v5.6.0
v5.5.0: Better null handlingCompare Source
This incorporates a few fixes related to how nulls are handles in array's and objects.
v5.3.0: Fix zero sized document crashCompare Source
This fixes a crash bug where submitted an empty slice as the document would panic.
v5.2.0Compare Source
v5.1.0Compare Source
v5.0.0: Proper Go modules releaseCompare Source
This release has a proper /v5 directory, unlike the previous releases that did not have a /v4 dir. Thanks to @BenTheElder for getting this sorted out!
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.