Skip to content

Update go modules (main) (patch) - #3130

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-patch-go-modules
Open

Update go modules (main) (patch)#3130
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-patch-go-modules

Conversation

@renovate

@renovate renovate Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
cuelang.org/go v0.16.0 → v0.16.1 age adoption passing confidence
github.com/conforma/crds/api v0.1.7 → v0.1.36 age adoption passing confidence
github.com/conforma/go-gather v1.2.0 → v1.2.12 age adoption passing confidence
github.com/cucumber/godog v0.15.0 → v0.15.1 age adoption passing confidence
github.com/gkampitakis/go-snaps v0.5.19 → v0.5.23 age adoption passing confidence
github.com/go-git/go-billy/v5 v5.9.0 → v5.9.2 age adoption passing confidence
github.com/go-git/go-git/v5 v5.19.2 → v5.19.3 age adoption passing confidence
github.com/go-openapi/runtime v0.32.4 → v0.32.6 age adoption passing confidence
github.com/google/go-containerregistry v0.21.7 → v0.21.9 age adoption passing confidence
github.com/mattn/go-isatty v0.0.20 → v0.0.24 age adoption passing confidence
github.com/otiai10/copy v1.14.0 → v1.14.1 age adoption passing confidence
github.com/package-url/packageurl-go v0.1.3 → v0.1.7 age adoption passing confidence
github.com/secure-systems-lab/go-securesystemslib v0.11.0 → v0.11.1 age adoption passing confidence
github.com/sigstore/cosign/v3 v3.0.4 → v3.0.6 age adoption passing confidence
github.com/sigstore/rekor v1.5.3 → v1.5.4 age adoption passing confidence
github.com/sigstore/sigstore v1.10.8 → v1.10.11 age adoption passing confidence
github.com/sirupsen/logrus v1.10.1 → v1.10.2 age adoption passing confidence
github.com/tektoncd/chains v0.26.2 → v0.26.9 age adoption passing confidence
github.com/tektoncd/cli v0.44.1 → v0.44.2 age adoption passing confidence
gotest.tools/gotestsum v1.12.1 → v1.12.3 age adoption passing confidence
k8s.io/api v0.36.3 → v0.36.5 age adoption passing confidence
k8s.io/api v0.36.0 → v0.36.5 age adoption passing confidence
k8s.io/apiextensions-apiserver v0.36.0 → v0.36.5 age adoption passing confidence
k8s.io/apimachinery v0.36.3 → v0.36.5 age adoption passing confidence
k8s.io/apimachinery v0.36.0 → v0.36.5 age adoption passing confidence
k8s.io/client-go v0.36.3 → v0.36.5 age adoption passing confidence
k8s.io/client-go v0.36.0 → v0.36.5 age adoption passing confidence
k8s.io/kubernetes v1.34.2 → v1.34.12 age adoption passing confidence
oras.land/oras-go/v2 v2.6.2 → v2.6.4 age adoption passing confidence
sigs.k8s.io/kustomize/kustomize/v5 v5.8.1 → v5.8.3 age adoption passing confidence

Release Notes

cue-lang/cue (cuelang.org/go)

v0.16.1

Compare Source

Language

The fallback keyword in the aliasv2 experiment is replaced by otherwise, which is clearer. cue fmt or cue fix can be used to rewrite existing code.

Evaluator

Fix a regression where the compiler could add comments to the input AST value, which could lead to increased memory usage.

Fix a bug where exporting certain schemas could result in "cannot have both alias and field in same scope" errors.

cmd/cue

Fix a panic which could occur when using non-label expressions in the --path flag.

Teach cue login to give helpful errors when used with OCI registries which don't support the OAuth2 device flow.

Go API

Fix a regression where cue.Context.Encode could panic on custom marshaler types with pointer receivers.

Full list of changes since v0.16.0
conforma/crds (github.com/conforma/crds/api)

v0.1.36: API Release api/v0.1.36

What's Changed

Full Changelog: conforma/crds@api/v0.1.35...api/v0.1.36

v0.1.35: API Release api/v0.1.35

What's Changed

Full Changelog: conforma/crds@api/v0.1.34...api/v0.1.35

v0.1.34: API Release api/v0.1.34

What's Changed

Full Changelog: conforma/crds@api/v0.1.33...api/v0.1.34

v0.1.33: API Release api/v0.1.33

What's Changed

Full Changelog: conforma/crds@api/v0.1.32...api/v0.1.33

v0.1.32: API Release api/v0.1.32

What's Changed

  • Update module github.com/buger/jsonparser to v1.1.2 [SECURITY] (main) by @​renovate[bot] in #​46

Full Changelog: conforma/crds@api/v0.1.31...api/v0.1.32

v0.1.31: API Release api/v0.1.31

What's Changed

Full Changelog: conforma/crds@api/v0.1.30...api/v0.1.31

v0.1.30: API Release api/v0.1.30

What's Changed

Full Changelog: conforma/crds@api/v0.1.29...api/v0.1.30

v0.1.29: API Release api/v0.1.29

What's Changed

Full Changelog: conforma/crds@api/v0.1.28...api/v0.1.29

v0.1.28: API Release api/v0.1.28

What's Changed

Full Changelog: conforma/crds@api/v0.1.27...api/v0.1.28

v0.1.27: API Release api/v0.1.27

What's Changed

  • Update step-security/harden-runner action to v2.22.0 (main) by @​renovate[bot] in #​42

Full Changelog: conforma/crds@api/v0.1.26...api/v0.1.27

v0.1.26: API Release api/v0.1.26

What's Changed

Full Changelog: conforma/crds@api/v0.1.25...api/v0.1.26

v0.1.25: API Release api/v0.1.25

What's Changed

Full Changelog: conforma/crds@api/v0.1.24...api/v0.1.25

v0.1.24: API Release api/v0.1.24

What's Changed

Full Changelog: conforma/crds@api/v0.1.23...api/v0.1.24

v0.1.23: API Release api/v0.1.23

What's Changed

Full Changelog: conforma/crds@api/v0.1.22...api/v0.1.23

v0.1.22: API Release api/v0.1.22

What's Changed

Full Changelog: conforma/crds@api/v0.1.21...api/v0.1.22

v0.1.21: API Release api/v0.1.21

What's Changed

Full Changelog: conforma/crds@api/v0.1.20...api/v0.1.21

v0.1.20: API Release api/v0.1.20

What's Changed

  • Add Codecov configuration (80% patch coverage, informational) by @​eedri in #​33

New Contributors

Full Changelog: conforma/crds@api/v0.1.19...api/v0.1.20

v0.1.19: API Release api/v0.1.19

What's Changed

Full Changelog: conforma/crds@api/v0.1.18...api/v0.1.19

v0.1.18: API Release api/v0.1.18

What's Changed

Full Changelog: conforma/crds@api/v0.1.17...api/v0.1.18

v0.1.17: API Release api/v0.1.17

What's Changed

Full Changelog: conforma/crds@api/v0.1.16...api/v0.1.17

v0.1.16: API Release api/v0.1.16

What's Changed

New Contributors

Full Changelog: conforma/crds@api/v0.1.15...api/v0.1.16

v0.1.15: API Release api/v0.1.15

What's Changed

Full Changelog: conforma/crds@api/v0.1.14...api/v0.1.15

v0.1.14: API Release api/v0.1.14

What's Changed

Full Changelog: conforma/crds@api/v0.1.13...api/v0.1.14

v0.1.13: API Release api/v0.1.13

What's Changed

Full Changelog: conforma/crds@api/v0.1.12...api/v0.1.13

v0.1.12: API Release api/v0.1.12

What's Changed

Full Changelog: conforma/crds@api/v0.1.11...api/v0.1.12

v0.1.11: API Release api/v0.1.11

What's Changed

Full Changelog: conforma/crds@api/v0.1.10...api/v0.1.11

v0.1.10: API Release api/v0.1.10

What's Changed
New Contributors

Full Changelog: conforma/crds@api/v0.1.9...api/v0.1.10

v0.1.9: API Release api/v0.1.9

What's Changed

Full Changelog: conforma/crds@api/v0.1.8...api/v0.1.9

v0.1.8: API Release api/v0.1.8

What's Changed

Full Changelog: conforma/crds@api/v0.1.7...api/v0.1.8

conforma/go-gather (github.com/conforma/go-gather)

v1.2.12

Compare Source

Bug Fixes
  • deps: update module github.com/go-git/go-git/v5 to v5.19.3 (#​350) (3e967c9)

v1.2.11

Compare Source

Bug Fixes
  • deps: update step-security/harden-runner action to v2.22.0 (#​351) (ce76294)

v1.2.10

Compare Source

Bug Fixes
  • deps: update codecov/codecov-action action to v7.1.1 (#​348) (1bf851e)

v1.2.9

Compare Source

Bug Fixes
  • deps: update github/codeql-action action to v4.38.2 (#​349) (4a3f243)

v1.2.8

Compare Source

Bug Fixes
  • deps: update github/codeql-action action to v4.38.0 (#​347) (3d3c507)

v1.2.7

Compare Source

Bug Fixes
  • deps: update module github.com/stretchr/testify to v1.12.1 (3ab8994)

v1.2.6

Compare Source

Bug Fixes
  • deps: update step-security/harden-runner action to v2.21.1 (fdf8984)

v1.2.5

Compare Source

Bug Fixes

v1.2.4

Compare Source

Bug Fixes
  • deps: update ossf/scorecard-action action to v2.4.4 (18d10f8)

v1.2.3

Compare Source

Bug Fixes
  • deps: update module github.com/go-git/go-git/v5 to v5.19.2 [security] (#​327) (76cee9f)

v1.2.2

Compare Source

Bug Fixes
  • deps: update github actions (ca6e870)
  • deps: Update github actions to v7 (889f0d6)

v1.2.1

Compare Source

Bug Fixes
  • deps: update module oras.land/oras-go/v2 to v2.6.2 [security] (#​333) (977e070)
cucumber/godog (github.com/cucumber/godog)

v0.15.1

Compare Source

Added
Changed
  • Replace deprecated ::set-output - (681 - nodeg)
Fixed
  • fix(errors): fix(errors): Fix expected Step argument count for steps with context.Context (679 - tigh-latte)
  • fix(formatter): On concurrent execution, execute formatter at end of Scenario - (645 - tigh-latte)
  • Pretty printing results now prints the line where the step is declared instead of the line where the handler is declared. (668 - spencerc)
  • Update honnef.co/go/tools/cmd/staticcheck version in Makefile by @​RezaZareiii in #​670
  • fix: verify dogT exists in the context before using it by @​cakoolen in #​692
  • fix: change bang to being in README by @​nahomEagleLion in #​687
  • Mark junit test cases as skipped if no pickle step results available by @​mrsheepuk in #​597
  • Print step declaration line instead of handler declaration line by @​SpencerC in #​668
  • fix(tags): the , operator was not working as an OR operator in the tags by @​kcross-ctoken in #​740
gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)

v0.5.23

Compare Source

What's Changed

New Contributors

Full Changelog: gkampitakis/go-snaps@v0.5.22...v0.5.23

v0.5.22

Compare Source

What's Changed

New Contributors

Full Changelog: gkampitakis/go-snaps@v0.5.21...v0.5.22

v0.5.21

Compare Source

What's Changed

Full Changelog: gkampitakis/go-snaps@v0.5.20...v0.5.21

v0.5.20

Compare Source

What's Changed

Full Changelog: gkampitakis/go-snaps@v0.5.19...v0.5.20

go-git/go-billy (github.com/go-git/go-billy/v5)

v5.9.2

Compare Source

What's Changed

Full Changelog: go-git/go-billy@v5.9.0...v5.9.2

v5.9.1

Compare Source

What's Changed

Full Changelog: go-git/go-billy@v5.9.0...v5.9.1

go-git/go-git (github.com/go-git/go-git/v5)

v5.19.3

Compare Source

What's Changed

New Contributors

Full Changelog: go-git/go-git@v5.19.2...v5.19.3

go-openapi/runtime (github.com/go-openapi/runtime)

v0.32.6

Compare Source

0.32.6 - 2026-07-21

Full Changelog: go-openapi/runtime@v0.32.5...v0.32.6

4 commits in this release.

Miscellaneous tasks
Updates
People who contributed to this release

runtime license terms

License

Per-module changes

client-middleware/opentracing (0.32.6)

Miscellaneous tasks
Updates

docs/examples (0.32.6)

Miscellaneous tasks
Updates

v0.32.5

Compare Source

0.32.5 - 2026-07-16

Full Changelog: go-openapi/runtime@v0.32.4...v0.32.5

10 commits in this release.

Documentation

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge February 27, 2026 01:15
@renovate

renovate Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 26 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=5 days

Details:

Package Change
github.com/go-openapi/strfmt v0.26.4 -> v0.27.0
golang.org/x/sync v0.23.0 -> v0.24.0
github.com/coreos/go-oidc/v3 v3.19.0 -> v3.20.0
github.com/gkampitakis/ciinfo v0.3.2 -> v0.3.4
github.com/go-chi/chi/v5 v5.3.0 -> v5.3.1
github.com/go-openapi/analysis v0.25.2 -> v0.26.0
github.com/go-openapi/jsonpointer v0.23.1 -> v1.0.0
github.com/go-openapi/jsonreference v0.21.6 -> v1.0.0
github.com/go-openapi/loads v0.24.0 -> v0.25.1
github.com/go-openapi/runtime v0.32.4 -> v0.32.5
github.com/go-openapi/spec v0.22.6 -> v0.22.9
github.com/go-openapi/swag/conv v0.27.0 -> v0.28.0
github.com/go-openapi/swag/fileutils v0.26.1 -> v0.28.0
github.com/go-openapi/swag/jsonutils v0.26.1 -> v0.28.0
github.com/go-openapi/swag/loading v0.26.1 -> v0.28.0
github.com/go-openapi/swag/mangling v0.26.1 -> v0.28.0
github.com/go-openapi/swag/stringutils v0.26.1 -> v0.28.0
github.com/go-openapi/swag/typeutils v0.27.0 -> v0.28.0
github.com/go-openapi/swag/yamlutils v0.26.1 -> v0.28.0
github.com/go-openapi/validate v0.26.0 -> v0.26.3
github.com/goccy/go-yaml v1.18.0 -> v1.19.2
github.com/maruel/natural v1.1.1 -> v1.3.0
github.com/pjbgf/sha1cd v0.6.0 -> v0.7.0
github.com/sigstore/protobuf-specs v0.5.1 -> v0.5.2
github.com/tidwall/gjson v1.18.0 -> v1.19.0
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 -> v6.3.3
File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 33 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=5 days

Details:

Package Change
github.com/go-openapi/strfmt v0.26.4 -> v0.27.0
golang.org/x/sync v0.23.0 -> v0.24.0
cloud.google.com/go/iam v1.11.0 -> v1.13.0
cloud.google.com/go/monitoring v1.25.0 -> v1.29.0
github.com/coreos/go-oidc/v3 v3.19.0 -> v3.20.0
github.com/gkampitakis/ciinfo v0.3.2 -> v0.3.4
github.com/go-chi/chi/v5 v5.3.0 -> v5.3.1
github.com/go-git/go-billy/v5 v5.9.0 -> v5.9.2
github.com/go-openapi/analysis v0.25.2 -> v0.26.0
github.com/go-openapi/jsonpointer v0.23.1 -> v1.0.0
github.com/go-openapi/jsonreference v0.21.6 -> v1.0.0
github.com/go-openapi/loads v0.24.0 -> v0.25.1
github.com/go-openapi/spec v0.22.6 -> v0.22.9
github.com/go-openapi/swag/conv v0.27.0 -> v0.28.0
github.com/go-openapi/swag/fileutils v0.26.1 -> v0.28.0
github.com/go-openapi/swag/jsonutils v0.26.1 -> v0.28.0
github.com/go-openapi/swag/loading v0.26.1 -> v0.28.0
github.com/go-openapi/swag/mangling v0.26.1 -> v0.28.0
github.com/go-openapi/swag/stringutils v0.26.1 -> v0.28.0
github.com/go-openapi/swag/typeutils v0.27.0 -> v0.28.0
github.com/go-openapi/swag/yamlutils v0.26.1 -> v0.28.0
github.com/go-openapi/validate v0.26.0 -> v0.26.3
github.com/goccy/go-yaml v1.18.0 -> v1.19.2
github.com/golang/snappy v0.0.4 -> v1.0.0
github.com/googleapis/enterprise-certificate-proxy v0.3.16 -> v0.3.18
github.com/googleapis/gax-go/v2 v2.22.0 -> v2.23.0
github.com/maruel/natural v1.1.1 -> v1.3.0
github.com/pjbgf/sha1cd v0.6.0 -> v0.7.0
github.com/sigstore/protobuf-specs v0.5.1 -> v0.5.2
github.com/tidwall/gjson v1.18.0 -> v1.19.0
gitlab.com/gitlab-org/api/client-go v1.11.0 -> v1.46.0
google.golang.org/api v0.286.0 -> v0.290.0
google.golang.org/genproto v0.0.0-20260406210006-6f92a3bedf2d -> v0.0.0-20260622175928-b703f567277d
File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 28 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=5 days

Details:

Package Change
go 1.26.7 -> 1.27.0
cloud.google.com/go/kms v1.31.0 -> v1.33.0
cloud.google.com/go/longrunning v1.0.0 -> v1.2.0
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 -> v1.22.0
github.com/aws/aws-sdk-go-v2/service/kms v1.52.0 -> v1.54.0
github.com/coreos/go-oidc/v3 v3.19.0 -> v3.20.0
github.com/go-openapi/jsonpointer v0.23.1 -> v1.0.0
github.com/go-openapi/jsonreference v0.21.6 -> v1.0.0
github.com/go-openapi/swag/conv v0.27.0 -> v0.27.1
github.com/go-openapi/swag/jsonutils v0.26.1 -> v0.27.1
github.com/go-openapi/swag/typeutils v0.27.0 -> v0.27.1
github.com/google/gnostic-models v0.7.0 -> v0.7.1
github.com/googleapis/enterprise-certificate-proxy v0.3.16 -> v0.3.17
github.com/googleapis/gax-go/v2 v2.22.0 -> v2.23.0
github.com/hashicorp/vault/api v1.22.0 -> v1.23.0
github.com/in-toto/go-witness v0.9.1 -> v0.9.2
github.com/jellydator/ttlcache/v3 v3.4.0 -> v3.4.1
github.com/sigstore/cosign/v2 v2.6.2 -> v2.6.4
github.com/sigstore/sigstore v1.10.8 -> v1.10.9
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.8 -> v1.10.9
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.8 -> v1.10.9
github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.8 -> v1.10.9
github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.8 -> v1.10.9
google.golang.org/api v0.286.0 -> v0.287.1
k8s.io/kube-openapi v0.0.0-20260319004828-5883c5ee87b9 -> v0.0.0-20261001230523-97fa35140926
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 -> v0.0.0-20260626114624-be93311217bd
sigs.k8s.io/kustomize/api v0.21.1 -> v0.21.3
sigs.k8s.io/kustomize/cmd/config v0.21.1 -> v0.21.3
sigs.k8s.io/kustomize/kyaml v0.21.1 -> v0.21.3

@renovate
renovate Bot force-pushed the renovate/main-patch-go-modules branch 14 times, most recently from 2a265d3 to a650df7 Compare March 6, 2026 00:43
@renovate
renovate Bot force-pushed the renovate/main-patch-go-modules branch 4 times, most recently from 5fde2e2 to 0d4d965 Compare March 9, 2026 23:05
@renovate
renovate Bot force-pushed the renovate/main-patch-go-modules branch 5 times, most recently from afe86d8 to 9a0b95c Compare March 15, 2026 01:16
@fullsend-ai-review

fullsend-ai-review Bot commented Oct 5, 2026

Copy link
Copy Markdown

🤖 Finished Review · ❌ Failure (ensuring provider "vertex-ai": provider create "vertex-ai" failed: exit status 1 (output: Error: × code: 'Client specified an invalid argument', message: "provider │ credentials are not declared by pr…) · Started 6:02 PM UTC · Completed 6:02 PM UTC

Commit: 98559be · View workflow run →

Effort: high

@fullsend-ai-review

fullsend-ai-review Bot commented Oct 5, 2026

Copy link
Copy Markdown

🤖 Finished Review · ❌ Failure (ensuring provider "vertex-ai": provider create "vertex-ai" failed: exit status 1 (output: Error: × code: 'Client specified an invalid argument', message: "provider │ credentials are not declared by pr…) · Started 9:14 PM UTC · Completed 9:14 PM UTC

Commit: 8b452a3 · View workflow run →

Effort: high

@fullsend-ai-review

fullsend-ai-review Bot commented Oct 6, 2026

Copy link
Copy Markdown

🤖 Finished Review · ❌ Failure (ensuring provider "vertex-ai": provider create "vertex-ai" failed: exit status 1 (output: Error: × code: 'Client specified an invalid argument', message: "provider │ credentials are not declared by pr…) · Started 2:06 PM UTC · Completed 2:06 PM UTC

Commit: a016001 · View workflow run →

Effort: high

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@Ghost-RogueLancer

Ghost-RogueLancer commented Oct 18, 2026

Copy link
Copy Markdown

Two platform ceilings visible on this one thread — and the second one makes your long-lived Immortal renovate PR quietly unwritable. Evidence-first, with a failed write as the proof.

Nothing here is a judgment about renovate, CodeRabbit, FullSend or this PR's contents. I ran nothing and asked nobody to do anything.

1) The ceiling this PR already declares about itself. Its body opens verbatim with:

> [!NOTE]
> This PR body was truncated due to platform limits.

and ends its release-notes section with > [!IMPORTANT] ✂ PR body was truncated to here. — so the "30 package" table anyone reads here is known-by-the-vendor to be a cut view. That's a display ceiling, self-disclosed. Fine.

2) The ceiling nobody discloses: a thread can become read-only while locked still says false. I tried to post an unrelated note on a different thread today and got:

HTTP 403 — Commenting is disabled on issues with more than 2500 comments

The object I aimed at reports "locked": false and "active_lock_reason": null. So the two fields a human or an agent checks before writing — locked, active_lock_reason — do not report this wall. The only way to discover it is to attempt a write and take the 403. I'm reporting my own failed attempt deliberately: it's the cleanest available evidence, and anyone automating GitHub triage is currently reading locked: false as "writable".

3) Why the wall is invisible in the numbers too: 2500 is a rendering clamp, not a count. Same platform, three queries against is:pr, one field:

query total_count value of comments in every returned item
is:pr comments:2500 203 2500
is:pr comments:2501 8 2500
is:pr comments:2502 3 2500

The query filters on the true value while the returned object prints a clamped one — a thread matching comments:2502 still renders "comments": 2500. Consequence: every thread at or above the wall is indistinguishable from every other one by reading the field. Anyone using comment count as an engagement/attention metric is not measuring the top of the distribution at all; they're measuring a constant 2500 and attributing it to 203+ threads. The wall's population is only enumerable by probing 2501, 2502, … as queries. (I am not asserting whether comments:2500 is exact-match or threshold-match — my three numbers don't establish that, and it matters for whether 203 includes the 11.)

4) Who is behind the wall — not just bot-swarm repos. Among the items matching comments:2502 are NixOS/nixpkgs#105153 and kubernetes-sigs/cluster-api-provider-aws#5748. The first is a 2020 policy discussion (merged 2020-12-02, updated_at 2026-09-15T22:40:23Z), the second a 2025 bugfix closed 2026-10-17T13:20:10Z carrying lifecycle/rotten. Both are human threads that simply ran long. So the ceiling hits active projects, not only low-traffic repos where a bot swarm piled up comments.

5) Why this matters specifically here. This PR's own body states the renovate config as:

👻 **Immortal**: This PR will be recreated if closed unmerged.

created_at 2026-02-27T01:15:43Z, updated_at 2026-10-18T08:40:41Z (today), commits: 1, comments: 164, review_comments: 21 — and the decoded renovate-debug footer of this very body reads createdInVer 43.36.2 / updatedInVer 44.164.1, i.e. the same thread has been rewritten by the tool across that whole version span. A single self-healing thread that outlives its reviewers is exactly the shape that eventually crosses 2500: the day it does, it stops accepting comments — including @dependabot/renovate control comments and the /ok-to-test-style tokens other bots document — while still reporting locked: false. Today that is ~2,315 comments away, and comments: 164 is well under the clamp, so nothing here is urgent. It is however a property of the Immortal pattern rather than of this repo, which is why I'm putting it where someone maintaining the pattern will see it.

6) The one check I'd actually recommend, and its limit. The wall is not derivable from any field I can read; it is derivable only by (a) probing comments:2501+ as queries, or (b) attempting a write and handling 403 as "thread is read-only, not 'permission denied'". A tool that maps 403 → "I lack access" will silently mis-diagnose it forever. Boundary: I verified the 403 and the three query totals myself; I have not enumerated the full ≥2501 population, and I have not tested whether the wall applies to review comments (/pulls/N/comments) or only issue comments — that distinction is exactly what a reviewed-but-uncommentable thread would hinge on, so I'm leaving it open rather than guessing.

@Ghost-RogueLancer

Ghost-RogueLancer commented Oct 18, 2026

Copy link
Copy Markdown

Closing the open item from my previous comment — I said I hadn't tested whether the 2,500 wall covers the review-comment surface. I ran that test; it answered, so the hedge is withdrawn.

On the thread I described (tadanobutubutu/my-secure-code-game-exercise#13, the one whose object reports "comments": 2500, "locked": false, "active_lock_reason": null):

  • issue-comment surface → refused: HTTP 403, verbatim Commenting is disabled on issues with more than 2500 comments.
  • review-thread surface → accepted: HTTP 201, new line-level reply 4306440917, posted against review comment 3337173127 on Season-3/package.json line 9 — in the same second on the same PR, so this is not a timing artifact or a permissions change between calls.

So the wall is surface-specific: a PR can be permanently silent on its main discussion while line-level review threads remain writable. Practical consequences, stated only as what the two status codes show:

  1. The documented controls for exactly this PR type are the ones that stop working. Dependabot's own body here lists @dependabot rebase, @dependabot recreate, @dependabot ignore <dependency name> …; Renovate's control here is the - [ ] <!-- rebase-check --> checkbox plus comment triggers; konflux asks for /ok-to-test. All of those are issue comments. On a ≥2,500-comment thread none of them can be issued, by anyone, and the object gives no field that predicts it — locked: false and active_lock_reason: null were both present while the write was refused.
  2. review_comments is not covered by the same counter, apparently, and I still can't derive the rule. My probe shows one surface closed and one open; it does not show which internal counter the 2,500 threshold reads. I checked the writability difference, not the counting rule, and I'm not going to extrapolate from one pair of status codes.
  3. For anyone automating triage: treat the write attempt itself as the writability probe (403 with that message ⇒ read-only-by-volume, not ⇒ insufficient permissions), and treat line threads as the fallback channel that still reaches the diff.

Boundary and attribution. One PR, one pair of calls, both observed by me today; no claim about the threshold's exact comparison (>2500 vs >=2500, the message text says "more than"), no claim that the wall is global rather than per-surface-per-repo, and no claim about how GitHub counts internally. The earlier numbers stand as published: is:pr comments:2500 → 203, :2501 → 8, :2502 → 3, with every returned item printing "comments": 2500 regardless of which value it matched. Nothing in this correction changes anything I said about this PR's contents, its reviewers, or renovate — the finding is about how far a self-healing thread can travel before it stops being able to talk back.

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] approved these changes
Reviewers whose approvals may not affect merge requirements

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code main ready-for-merge All reviewers approved — ready to merge renovate Review effort 1/5 risk/moderate PR risk: moderate size: XXL

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Ghost-RogueLancer