Repository navigation
chore(deps): refresh Go, Worker, Actions and runner image dependencies - #2453
Merged
Merged
Conversation
Update direct and reachable transitive modules, migrate Azure compute/network/resources and regexp2, and preserve Go 1.26.5. Hold Incus at 7.3.0 because 7.4 requires Go 1.26.7. Retain the newer jsonschema fork revision and stable SFTP, OIDC, and Connect majors. Validated with go vet, focused race tests for Azure/schema, AWS/GCP and provider adapters, plus Linux cross-vet for Firecracker and Phala.
Upgrade Vitest to 5.0.1 and refresh AWS credentials, pg-boss, Cloudflare types, Wrangler, formatting and lint tooling. Keep Node 22 types aligned with the supported runtime floor; opt out of the newly enabled function-scoping style rule. Verified clean npm installation, both TypeScript configurations, lint, formatting, focused Vitest files, Node build and Worker dry-run. Final lockfile also refreshes compatible transitive dependencies.
Use current stable action commits, refresh multi-platform runner digests and deadcode tooling, and preserve Rust 1.90 warnings-as-errors explicitly. Keep existing Bookworm and Ubuntu baselines; MCR runtime-deps 10 has no Bookworm image. Cloudflare runner tool pins already match latest releases. Record one Unreleased dependency-refresh entry. Workflow/pin checks, generated-source checks and focused script tests pass.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
Contributor
|
Codex review: needs real behavior proof before merge. Reviewed September 21, 2026, 2:14 PM ET / 18:14 UTC (Revision 2). ClawSweeper reviewWhat this changesRefresh Go and Worker dependencies, update pinned Actions and container images, adapt Azure and regexp imports, and move the Node coordinator container to Node 24. Merge readiness⛔ Blocked before merge - 5 items remain The refresh remains useful and is absent from current main and v0.63.0. No concrete introduced correctness bug was established, but existing-database upgrade validation and the dependency security alert remain unresolved. Priority: P2 Review scores
Verification
How this fits togetherThese dependencies support Crabbox’s provider CLI, coordinator, and build workflows. The Node coordinator also starts a PostgreSQL job scheduler that maintains durable alarms and reconciliation schedules. flowchart TD
A[Dependency manifests and pins] --> B[CLI and provider clients]
A --> C[Build and release workflows]
A --> D[Node coordinator]
D --> E[Job scheduler startup]
F[Existing PostgreSQL jobs and schedules] --> E
E --> G[Schema migration and scheduled work]
Before merge
Findings
Agent review detailsSecurityNeeds attention: Pins and permission boundaries appear consistent, but the CNI package-level obfuscation alert remains untriaged. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Retain the refresh with demonstrated PostgreSQL upgrade and recovery behavior, and a documented source-level disposition of the CNI alert. Do we have a high-confidence way to reproduce the issue? Not applicable: this PR refreshes dependencies rather than reporting a specific runtime bug; no introduced failure was reproduced. Is this the best way to solve the issue? Unclear until upgrade validation is supplied: the narrow import adaptations and compatibility holds are reasonable, but fresh-start tests do not establish safety for existing PostgreSQL job databases. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 6aa35cea5840. LabelsLabel changes:
Label justifications:
EvidenceSecurity concerns:
What I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (1 earlier review cycle)
|
Restore Incus 7.1.0 because 7.3 switches client config discovery to os.UserConfigDir and migrates trust state on read. Retain YAML v4 rc.4 for its yaml.V2 API and Scaleway beta.36, since beta.37 requires the incompatible YAML rc.6. Tidy removes the unused Incus transitive dependencies. Restore deadcode 0.45.0 to match the unchanged exact CI command contract. Full Incus/scripts race tests and focused Scaleway transport/lifecycle tests pass with Go 1.26.5; test assertions remain unchanged.
clawsweeper
Bot
added
P2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refresh all dependencies to current releases, in three commits:
regexp2v2),go mod tidy, generated runner dependency manifests regenerated. Intentional holds: Incus client at 7.3 (later versions need a newer Go toolchain than the pinned 1.26.5), and prerelease majors.scripts/check-docker-base-images.mjsexpects.Verification
go vet ./..., Linux cross-vet and deadcode, focused race tests for affected packages.Health checks and the exact holds are in the commit messages.