Update dependency golang to v1.26.5 (main) by red-hat-konflux[bot] · Pull Request #3367 · conforma/cli

red-hat-konflux · 2026-06-27T01:37:19Z

This PR contains the following updates:

Package	Update	Change
golang	patch	`1.26.3` → `1.26.5`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

golang/go (golang)

`v1.26.5`

Compare Source

`v1.26.4`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

fullsend-ai-review · 2026-06-27T01:39:59Z

🤖 Review · ⚠️ Cancelled · Started 1:39 AM UTC · Ended 1:41 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-27T01:45:18Z

🤖 Review · ⚠️ Cancelled · Started 1:45 AM UTC · Ended 1:48 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-27T01:51:08Z

🤖 Finished Review · ✅ Success · Started 1:51 AM UTC · Completed 1:58 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-06-27T01:58:28Z

Review — approve

Scope: Automated Go toolchain patch update via Renovate (MintMaker).

Change summary

This PR updates the Go version in .tool-versions from 1.26.3 to 1.26.5, a patch-level bump. The change is a single line in a single file.

Analysis

Dimension	Assessment
Correctness	✅ Version string is valid. The `.tool-versions` format is preserved. Patch update from 1.26.3 to 1.26.5 is straightforward.
Security	✅ Go patch releases typically include security fixes. Updating is a positive security action.
Intent & scope	✅ Appropriately scoped. Other Go version references (`go.mod`, `Dockerfile`, `Dockerfile.dist`) are managed by separate Renovate PRs, all of which are currently open.
Style	✅ No style concerns — single-line version file.
Documentation	✅ No documentation impact.
Cross-repo contracts	✅ No API surface changes.

Notes

The auto_merge.commit_title field references v1.26.4 (the version when the PR was originally created), but the PR content correctly targets v1.26.5. This is a benign Renovate metadata artifact.
The ready-for-merge label is present. The PR is not in draft state.

No findings.

Previous run

Review of #3367 — Update dependency golang to v1.26.5

Verdict: Approve ✅

This is a Renovate (MintMaker) bot PR that bumps the Go version in .tool-versions from 1.26.3 to 1.26.5 — a patch-level update.

Change analysis

Dimension	Assessment
Correctness	✅ Single-line version string replacement. Syntactically correct.
Security	✅ Go patch releases contain bug fixes and security patches. Upgrading is beneficial.
Intent & coherence	✅ Standard automated dependency update from Renovate, appropriately scoped to the file it manages.
Style/conventions	✅ Follows existing file format.
Documentation	✅ No documentation impact.
Cross-repo contracts	✅ No external API or schema changes.

Notes

Go version skew across config files (low): The .tool-versions file (used by asdf/mise for local development) will reference Go 1.26.5, while go.mod (root, tools/, tools/kubectl/, acceptance/), Dockerfile, and Dockerfile.dist still pin Go 1.26.3. For patch versions this is safe — Go guarantees backward compatibility — but the skew means local development may use a slightly different Go version than CI/production builds. These other files are likely managed by separate Renovate rules or updated manually, so this is expected behavior rather than an oversight.

Previous run (2)

Review — ✅ Approve

PR: #3367 — Update dependency golang to v1.26.5 (main)
Scope: Single-line version bump in .tool-versions (golang 1.26.3 → 1.26.5)
Author: red-hat-konflux[bot] (Renovate/MintMaker)

Summary

This is a mechanical patch-level Go toolchain version bump in .tool-versions, used by asdf/mise for local development environments. The change is minimal and safe.

Findings

Version skew across Go version pins · low
.tool-versions will be at Go 1.26.5 while go.mod (root, acceptance/, tools/, tools/kubectl/) and Dockerfiles (Dockerfile, Dockerfile.dist) remain pinned to Go 1.26.3. This is expected behavior for Renovate's per-manager update strategy — separate open PRs (#3372, #3368) already cover the Dockerfile updates. The go directive in go.mod is managed independently and patch-level skew does not pose a functional risk, since Go's toolchain directive handles forward compatibility.

Dimensions reviewed

Dimension	Result
Correctness	✅ No logic, tests, or production code changed
Security	✅ No secrets, injection patterns, or permission changes
Intent & coherence	✅ Mechanical change, authorization implicit
Style & conventions	✅ Value follows existing `.tool-versions` format
Docs currency	✅ No documentation references the specific Go version
Cross-repo contracts	⏭ Skipped — no exported interfaces modified

Previous run (3)

Review — Approve ✅

PR: #3367 — Update dependency golang to v1.26.4 (main)
Author: red-hat-konflux[bot] (automated Renovate/MintMaker)
Change scope: 1 file, 1 addition, 1 deletion

Summary

Automated patch version bump of the Go toolchain in .tool-versions from 1.26.3 → 1.26.4. This is a standard Renovate-managed dependency update targeting the local development toolchain version (asdf/mise).

Analysis

Dimension	Result
Correctness	✅ Mechanical single-line version bump. No logic changes.
Security	✅ Go patch releases typically include security fixes — this update is beneficial.
Intent & coherence	✅ Change matches PR title. `.tool-versions` is in scope; other version pins (go.mod, Dockerfiles) are managed by separate Renovate update rules.
Style/conventions	✅ File format preserved.
Documentation	✅ No documentation impact.
Cross-repo contracts	✅ No API or interface changes.

Findings

No findings.

Previous run (4)

Review of #3367 — Update dependency golang to v1.26.4

Verdict: ✅ Approve

Summary

Automated Renovate patch-version bump of Go from 1.26.3 → 1.26.4 in .tool-versions. This file controls local developer tooling (asdf/mise) and does not affect CI builds or module compatibility.

Analysis

Dimension	Assessment
Correctness	✅ Single-line version string substitution; format preserved.
Security	✅ Go patch releases routinely include security fixes. Updating is beneficial.
Intent & coherence	✅ Standard automated dependency update via Renovate bot, consistent with project's dependency management strategy.
Style/conventions	✅ Follows existing `.tool-versions` format.
Documentation	✅ No documentation impact.
Cross-repo contracts	✅ `.tool-versions` is local tooling configuration; no external contract implications.

Notes

Other Go version references (Dockerfile line 19, Dockerfile.dist line 19, go.mod, tools/go.mod, acceptance/go.mod) remain at 1.26.3. This is expected behavior — Renovate manages each file type through separate managers (Docker, gomod, asdf) with independent update cadences.
Automerge is enabled for this PR, which is appropriate for an automated patch-level dependency bump.

No blocking findings.

Previous run (5)

Review — approve

PR: #3367 — Update dependency golang to v1.26.4 (main)

Summary

Routine patch version bump of Go toolchain from 1.26.3 to 1.26.4 in .tool-versions, generated by Renovate/MintMaker. The change is minimal (1 line changed) and safe.

Dimension results

Dimension	Result
Correctness	✅ No blocking findings (2 low — version skew)
Security	✅ No findings
Intent & Coherence	✅ Mechanical change — authorization implicit
Style & Conventions	✅ No findings — early exit (value-only change)
Documentation Currency	✅ No findings
Cross-repo Contracts	⏭ Skipped — no API surface modified

Findings

[low] Version inconsistency between .tool-versions and go.mod files

File: go.mod (line 3), also acceptance/go.mod, tools/go.mod, tools/kubectl/go.mod
Category: version inconsistency

The go directive in go.mod and its sub-module counterparts still specifies 1.26.3 while .tool-versions is being updated to 1.26.4. This creates a minor version skew between the local developer toolchain and the declared Go module version. For a patch-level bump this is unlikely to cause build failures, and Renovate typically manages go.mod updates via a separate PR.

[low] Version inconsistency between .tool-versions and Dockerfiles

File: Dockerfile (line 19), also Dockerfile.dist (line 19)
Category: version inconsistency

The Dockerfile build stages still use golang:1.26.3 / go-toolset:1.26.3 as base images. After this PR, the local toolchain (governed by .tool-versions) will be 1.26.4 while container builds use 1.26.3. These are likely updated via separate Renovate PRs for container image managers.

Verdict

Approve. This is a safe, routine Go patch version bump. The version skew with go.mod and Dockerfiles is expected behavior for Renovate's per-manager update strategy and poses no risk for a patch-level change.

Previous run (6)

Looks good to me

Previous run (7)

Review

Findings

Medium

[stale-reference] Dockerfile:19 — Dockerfile still uses golang:1.26.3 base image while .tool-versions is bumped to 1.26.4, creating version skew between local development (asdf/mise) and container builds.
Remediation: Update the FROM line to golang:1.26.4, or have Renovate/Mintmaker handle Dockerfile updates in the same PR.
[stale-reference] Dockerfile.dist:19 — Dockerfile.dist still pins go-toolset:1.26.3 (with digest). The Go toolchain version is now inconsistent with .tool-versions (1.26.4). The UBI image tag for 1.26.4 may not yet be available.
Remediation: Update the tag to 1.26.4 with the correct digest once the UBI image is published.

Low

[stale-reference] go.mod:3 — Root go.mod still declares go 1.26.3. The go directive is a minimum version floor, so this is cosmetic — Go 1.26.4 builds modules declaring go 1.26.3 without issue.
Remediation: Run go mod tidy with Go 1.26.4.
[stale-reference] tools/go.mod:3, tools/kubectl/go.mod:3, acceptance/go.mod:3 — All secondary go.mod files still declare go 1.26.3. Same cosmetic concern as root go.mod.
Remediation: Update the go directive to 1.26.4 in each module.

Labels: Go toolchain patch version bump managed by renovate bot.

fullsend-ai-review · 2026-07-02T01:44:59Z

🤖 Finished Review · ✅ Success · Started 1:44 AM UTC · Completed 1:48 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review · 2026-07-08T01:49:30Z

🤖 Finished Review · ✅ Success · Started 1:49 AM UTC · Completed 1:55 AM UTC
Commit: 7c8ccca · View workflow run →

fullsend-ai-review · 2026-07-09T01:39:44Z

🤖 Finished Review · ✅ Success · Started 1:39 AM UTC · Completed 1:43 AM UTC
Commit: 8f05d87 · View workflow run →

fullsend-ai-review · 2026-07-10T01:32:49Z

🤖 Finished Review · ✅ Success · Started 1:32 AM UTC · Completed 1:35 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-07-11T01:40:37Z

🤖 Finished Review · ✅ Success · Started 1:40 AM UTC · Completed 1:47 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-07-14T01:31:00Z

🤖 Finished Review · ✅ Success · Started 1:30 AM UTC · Completed 1:35 AM UTC
Commit: 87c4a29 · View workflow run →

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

fullsend-ai-review · 2026-07-15T01:23:23Z

🤖 Finished Review · ✅ Success · Started 1:23 AM UTC · Completed 1:26 AM UTC
Commit: 87c4a29 · View workflow run →

red-hat-konflux Bot added main renovate labels Jun 27, 2026

red-hat-konflux Bot enabled auto-merge June 27, 2026 01:37

github-actions Bot added the size: XS label Jun 27, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/golang-1.26.x branch from 6e95e1e to 3e45e8a Compare June 27, 2026 01:40

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/golang-1.26.x branch from 3e45e8a to ce99fec Compare June 27, 2026 01:48

fullsend-ai-review Bot added requires-manual-review Review requires human judgment go Pull requests that update Go code dependencies Pull requests that update a dependency file labels Jun 27, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/golang-1.26.x branch from ce99fec to cda16a0 Compare July 2, 2026 01:40