Uh oh!
There was an error while loading. Please reload this page.
chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 in the golang-x group - #530
Merged
LukasWodka merged 1 commit intoAug 22, 2026
Conversation
Bumps the golang-x group with 1 update: [golang.org/x/text](https://github.com/golang/text). Updates `golang.org/x/text` from 0.40.0 to 0.41.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.40.0...v0.41.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x ... Signed-off-by: dependabot[bot] <support@github.com>
ContributorAuthor
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
LukasWodka added a commit
that referenced
this pull request
Aug 20, 2026
I claimed in chat that this PR was unaffected by the Dependabot finding on averaging-service#367. Wrong, and this repo is the worse case of the two. Dependabot branches live in THIS repo, not a fork, so `github.event.pull_request.head.repo.fork` is FALSE on them -- verified on the real #530: head.repo.fork=false, head.repo.full_name=tracebloc/cli. Their runs still receive only Dependabot-scoped secrets, so BACKEND_CONTRACTS_TOKEN is empty. Under the previous commit that combination landed in the "absent, same-repo -> misconfiguration -> FAIL" branch, which would have blocked every Dependabot PR once the context is armed. Not theoretical: this repo has 4 Dependabot PRs, #530 is OPEN right now, and it currently reports `Backend fixtures drift check: success` -- the fail-open passing vacuously on a live PR today. So Dependabot gets a fourth branch, passing with a ::notice::. Safe for the same structural reason as averaging-service#367, via a different always-running guard: a dependency bump cannot alter internal/api/testdata/*.json, and if it did, internal/api/contracts_test.go replays every fixture through the real decode paths under the REQUIRED `Test` check with no token. Drift against the pinned backend ref is re-checked by the push run on develop/main, where Actions secrets are available. Mutation-proved, all five: Dependabot PR (fork=false, no token) exit 0 (notice: deferred) fork PR, no token exit 1 (could not run) human same-repo, no token exit 1 (secret missing) token present exit 0 (real check ran) override label exit 0 (OVERRIDDEN warning) PR_AUTHOR uses github.event.pull_request.user.login, not github.actor, so it stays correct across re-runs. Refs tracebloc/backend#2212 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
saqlainsyed007
approved these changes
Aug 20, 2026
saqlainsyed007
left a comment
Contributor
There was a problem hiding this comment.
Reviewed for correctness — clean, approving.
What this does: Dependabot bump of golang.org/x/text 0.40.0 → 0.41.0 (golang-x group). Touches only go.mod and go.sum.
Correctness checks:
golang.org/x/textis used directly (internal/slug/slug.go,internal/schema/validate.go), so the bump is relevant. 0.41.0 is a minor release whose notable change is a precis Nickname-profile buffer fix — low risk, no API changes affecting this module.go.sumupdated consistently: old 0.40.0 h1 + go.mod hashes removed, new 0.41.0 pair added.- The
github.com/spf13/pflagindirect→direct promotion looked odd for a text-only bump, but it's correct:internal/cli/telemetry_test.goimports pflag directly, so a test-file import makes it a direct dependency andgo mod tidy(run by Dependabot) correctly strips the// indirecttag. develop's go.mod was simply slightly untidy before.
No correctness, convention, or security concerns.
LukasWodka added a commit
that referenced
this pull request
Aug 20, 2026
* ci(2212): the fixtures drift check must fail when it cannot run
`Backend fixtures drift check` is being armed as a required context
(backend#2212). Its activation-phase fail-open has to go first: when
BACKEND_CONTRACTS_TOKEN was unreadable the step printed a warning and exited 0,
so a check that never executed reported as a passing one. Inert-not-red was the
right call while the secret did not exist; the secret has existed since
2026-08-05, and once the context is required an exit-0-when-unable is strictly
worse than an advisory guard, because it also looks solved (backend#2183).
`cli` is PUBLIC, so the two reasons the token can be missing are different
things and the step now splits three ways:
token present -> run the check
absent, fork PR -> FAIL. GitHub withholds repo secrets from forks by
design, so the check genuinely cannot run. A maintainer
verifies internal/api/testdata/*.json by hand and
applies `skip-fixtures-drift` -- a permanent artifact on
the PR, the same model as skip-fr-gate. Silently passing
forks would fail open on exactly the contributions that
deserve the most scrutiny.
absent, same-repo -> FAIL. Rotated, removed or expired: a misconfiguration
that used to read as a clean run.
`types: [.., labeled, unlabeled]` added to the pull_request trigger, because
without them the default opened/synchronize/reopened means applying the override
label changes nothing until the next push -- the same defect Bugbot caught on
version-bump-gate-caller.yml's skip-version-gate.
Every ${{ }} goes through env:, none into the run: body.
Mutation-proved, all five paths, by running the step body against a stubbed
sync script:
override label present exit 0 (OVERRIDDEN warning)
token present exit 0 (real check ran)
token absent, fork PR exit 1 (could not run)
token absent, same-repo exit 1 (secret missing)
token present, script reports drift exit 3 (exec propagates the status)
The last one matters: `exec` replaces the shell, so a real drift failure still
fails the step rather than being swallowed.
Label `skip-fixtures-drift` created on this repo.
Refs tracebloc/backend#2212
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(2212): Dependabot PRs are not forks, and would have been blocked
I claimed in chat that this PR was unaffected by the Dependabot finding on
averaging-service#367. Wrong, and this repo is the worse case of the two.
Dependabot branches live in THIS repo, not a fork, so
`github.event.pull_request.head.repo.fork` is FALSE on them -- verified on the
real #530: head.repo.fork=false, head.repo.full_name=tracebloc/cli. Their runs
still receive only Dependabot-scoped secrets, so BACKEND_CONTRACTS_TOKEN is
empty. Under the previous commit that combination landed in the "absent,
same-repo -> misconfiguration -> FAIL" branch, which would have blocked every
Dependabot PR once the context is armed.
Not theoretical: this repo has 4 Dependabot PRs, #530 is OPEN right now, and it
currently reports `Backend fixtures drift check: success` -- the fail-open
passing vacuously on a live PR today.
So Dependabot gets a fourth branch, passing with a ::notice::. Safe for the same
structural reason as averaging-service#367, via a different always-running
guard: a dependency bump cannot alter internal/api/testdata/*.json, and if it
did, internal/api/contracts_test.go replays every fixture through the real
decode paths under the REQUIRED `Test` check with no token. Drift against the
pinned backend ref is re-checked by the push run on develop/main, where Actions
secrets are available.
Mutation-proved, all five:
Dependabot PR (fork=false, no token) exit 0 (notice: deferred)
fork PR, no token exit 1 (could not run)
human same-repo, no token exit 1 (secret missing)
token present exit 0 (real check ran)
override label exit 0 (OVERRIDDEN warning)
PR_AUTHOR uses github.event.pull_request.user.login, not github.actor, so it
stays correct across re-runs.
Refs tracebloc/backend#2212
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>LukasWodka added a commit
that referenced
this pull request
Aug 20, 2026
`Installer (shell)` is a REQUIRED status check on develop, and its first action was an `apt-get` with no retry and no time bound of its own. A slow package mirror therefore consumed the whole 10-minute job budget before any shell was parsed, and blocked every PR in the repo while doing it. MEASURED, not theorised. cli#533 is a workflow-only diff that cannot touch installer behaviour, and it failed FOUR consecutive times: job 96126585157 Installer (shell) failure 10m16s 15:34 Set up job 15:34 Run actions/checkout 15:34 shellcheck + dash parse <- 10 minutes here, then killed 15:44 Post Run actions/checkout Nothing after the `apt-get` line ever ran. And the annotation read `The job has exceeded the maximum execution time of 10m0s` on a job called `Installer (shell)`, so whoever sees it reasonably concludes the installer is hanging. Nothing points at apt. NOT REPO-WIDE, which is worth stating because the ticket first implied it: #530 and #526 pass the same check. It reproduced on one head, four times. THE FIX REMOVES THE DEPENDENCY RATHER THAN HARDENING IT. Both tools are already on `ubuntu-latest`: * shellcheck is preinstalled -- tracebloc/.github's own `quality / shellcheck` job, a REQUIRED check in 16 repos, calls `shellcheck --version` with no install at all. The org has depended on that fleet-wide for as long as that job existed. * dash IS Ubuntu's /bin/sh, an essential package. A retry-with-timeout around apt would have been the smaller diff and the worse fix: a step that installs nothing cannot stall on a mirror, and no wrapper can say that. `shellcheck --version | head -2` is kept as the first line, matching what the org's own shellcheck job does -- so the version in use is in the log, and an absent binary fails on line one with an obvious message instead of somewhere further down. THIS PR'S OWN RUN IS THE PROOF, and that is deliberate: if either tool were missing the step fails loudly here, before merge. Better than any claim in the comment. Verified locally too: shellcheck --shell=sh --severity=error scripts/install.sh clean, dash -n scripts/install.sh clean. Closes#534. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
LukasWodka
self-requested a review
August 22, 2026 10:33
LukasWodka
approved these changes
Aug 22, 2026
LukasWodka
left a comment
Contributor
There was a problem hiding this comment.
Approving. Routine bump, but there are two things in it worth having read rather than waved through.
The pflag indirect → direct move is a correction, not noise.internal/cli/telemetry_test.go:14 imports github.com/spf13/pflag, and a package imported by this module's own tests is a direct dependency — so the // indirect marker on develop was wrong. Dependabot fixed it as a side effect of tidying. go mod tidy on this head produces no diff to either go.mod or go.sum, which is the authoritative confirmation.
The upstream change isn't load-bearing here. v0.41.0's substantive commit is secure/precis: fix short destination buffer handling in Nickname profile; secure/precis isn't reachable from this module. go list -deps shows the CLI reaches transform, width, language, unicode/norm and friends — none of them touched. So this is hygiene, not a security-relevant bump, and nobody should read the PRECIS wording as an urgent fix.
go build ./... clean.
One observation, non-blocking and arguably fixed by this PR: develop's go.mod was untidy — it carried pflag v1.0.9 // indirect while a test in the module imported it directly — which means nothing in CI runs a tidy check. This repo already has drift gates for the things that matter (Schema drift check, Backend fixtures drift check, chart-drift), so a go mod tidy -diff step would fit the house pattern and would have caught this without waiting for a dependency bump to stumble over it. Your call whether that's worth a ticket.
Uh oh!
There was an error while loading. Please reload this page.
LukasWodka
deleted the
dependabot/go_modules/develop/golang-x-fef239f7b3
branch
August 22, 2026 10:39
LukasWodka
commented
Aug 22, 2026
Contributor
/fr-pass |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the golang-x group with 1 update: golang.org/x/text.
Updates
golang.org/x/textfrom 0.40.0 to 0.41.0Commits
acdba66go.mod: update golang.org/x dependencies02aa981secure/precis: fix short destination buffer handling in Nickname profileDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions