Skip to content

chore(deps): update google.golang.org/genproto/googleapis/api digest to 87f3d3e #218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
red-hat-konflux-kflux-prd-rh02 wants to merge 1 commit into from
Closed

chore(deps): update google.golang.org/genproto/googleapis/api digest to 87f3d3e #218

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ require (
golang.org/x/sync v0.20.0 // indirect
golang.org/x/sys v0.42.0 // indirect
golang.org/x/text v0.35.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
google.golang.org/genproto/googleapis/api 87f3d3e198d3 // indirect

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify go.sum contains entry for the corrected pseudo-version once fixed
rg -A2 'google.golang.org/genproto/googleapis/api' go.sum

Repository: openshift-hyperfleet/hyperfleet-api

Length of output: 593

🏁 Script executed:

#!/bin/bash
# Check actual go.mod around line 149
echo "=== go.mod line 145-155 ==="
sed -n '145,155p' go.mod

echo -e "\n=== Full go.mod google.golang.org/genproto entries ==="
rg 'google\.golang\.org/genproto' go.mod

echo -e "\n=== Full go.sum google.golang.org/genproto entries ==="
rg 'google\.golang\.org/genproto' go.sum | head -20

Repository: openshift-hyperfleet/hyperfleet-api

Length of output: 2078

go.mod/go.sum sync broken — invalid version format prevents build verification (CWE-829).

Line 149 declares google.golang.org/genproto/googleapis/api 87f3d3e198d3 using a bare commit hash, which is not a valid Go module version. Go requires pseudo-version format (v0.0.0-YYYYMMDDHHMMSS-COMMITHASH). Additionally, go.sum contains only entries for v0.0.0-20260401024825-9d38bb4040a9, creating a sync mismatch — no checksums exist for the declared dependency. This breaks reproducible builds and prevents integrity verification.

Correct the version to a proper pseudo-version and run go mod tidy to regenerate go.sum checksums.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 149, The dependency google.golang.org/genproto/googleapis/api
on line 149 uses a bare commit hash `87f3d3e198d3` which is not a valid Go
module version format. Replace this with a proper Go pseudo-version in the
format `v0.0.0-YYYYMMDDHHMMSS-COMMITHASH` where the timestamp and commit hash
correspond to the actual commit. After updating the version string in go.mod,
run `go mod tidy` to regenerate the go.sum file with the correct checksums that
match the updated dependency declarations and ensure build reproducibility.

Source: Coding guidelines

google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
google.golang.org/grpc v1.80.0 // indirect
google.golang.org/protobuf v1.36.11 // indirect
Expand Down