Fix Dependabot configurations and update gRPC to patched version - #96
Merged
Merged
Conversation
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com>
Removed Docker update configuration from Dependabot.
) * Initial plan * fix(dependabot): remove duplicate grpc update targets Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> * fix(security): bump grpc to patched v1.83.2 Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
Restore standalone Docker Dependabot coverage and update or remove obsolete replacement commands and overrides.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR upgrades gpuagent Go dependencies, including gRPC, and refines Dependabot tracking.
Changes:
- Updates gRPC and related indirect dependencies.
- Removes obsolete dependency replacements.
- Adjusts Dependabot grouping and Go module patterns.
File summaries
| File | Summary |
|---|---|
sw/nic/gpuagent/go.sum |
Adds checksums for upgraded dependencies. |
sw/nic/gpuagent/go.mod |
Updates dependency versions and replacement directives. |
.github/dependabot.yml |
Refines Go tracking and Dependabot grouping. |
Review details
Suppressed comments (1)
sw/nic/gpuagent/go.mod:20
- With these requirements raised to x/net v0.58.0, x/sys v0.47.0, and x/text v0.41.0, the exact-version replacements still retained below (v0.53, v0.39, and v0.38, plus the older x/net override) no longer apply to the selected module versions. Leaving those obsolete overrides, and the matching
make modcommands, makes the dependency graph misleading and defeats the stated replace-directive cleanup; remove or update them together.
golang.org/x/net v0.58.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/text v0.41.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
- Files reviewed: 2/3 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates the dependencies for the
gpuagentGo module and refines the Dependabot configuration for the build and Go ecosystem. The main changes include upgrading several Go dependencies to more recent versions and simplifying how Dependabot tracks and groups updates.Dependency upgrades:
google.golang.org/grpcfromv1.69.0-devtov1.83.2and removed the custom replace directives, ensuring the latest stable release is used.golang.org/x/nettov0.58.0,golang.org/x/systov0.47.0,golang.org/x/texttov0.41.0, andgoogle.golang.org/genproto/googleapis/rpcto a newer commit.replacedirectives ingo.modfor a more streamlined dependency management.Dependabot configuration improvements:
.github/dependabot.ymlto remove the Docker ecosystem from thegpuagent-build-and-gogroup, and added apatternsfield to match all Go modules in/sw/nic/gpuagent, simplifying and focusing automated dependency tracking.