fix(deps): update module github.com/vektah/gqlparser/v2 to v2.5.37 - #306
Merged
patrick-hermann-sva merged 2 commits intoSep 5, 2026
Merged
Conversation
Contributor
Author
|
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
June 18, 2026 10:20
4874453 to
2f2c975
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
June 18, 2026 10:26
2f2c975 to
8fba023
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
June 19, 2026 18:12
8fba023 to
7381bd2
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
July 1, 2026 22:05
7381bd2 to
a1cf7da
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
July 28, 2026 08:02
a1cf7da to
91d8cb2
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
August 12, 2026 03:15
91d8cb2 to
a5de94a
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
August 18, 2026 16:47
a5de94a to
4e6e230
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
August 26, 2026 18:34
4e6e230 to
23ac947
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
2 times, most recently
from
August 30, 2026 02:55
23ac947 to
8e86285
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
2 times, most recently
from
August 31, 2026 04:51
8e86285 to
9e145a6
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
September 1, 2026 00:59
9e145a6 to
50a4178
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
2 times, most recently
from
September 1, 2026 18:39
50a4178 to
d971d4d
Compare
renovate
Bot
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
September 5, 2026 05:58
d971d4d to
79460da
Compare
patrick-hermann-sva
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
September 5, 2026 10:31
79460da to
578dd36
Compare
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Renovate raised github.com/vektah/gqlparser/v2 to v2.5.37 in 28 go.mod files but its artifacts step failed, so no go.sum was updated. The branch would have landed on main with go.mod and go.sum disagreeing in every module it touched. `dagger functions` passed on all 28 modules regardless, because `dagger develop` regenerates go.sum inside the container. CI green was never evidence that the committed tree was consistent -- that is the whole reason this PR sat open. Ran `go mod tidy` in each of the 27 modules the bump touches, then `go build` and `go vet` in each. All pass. Verified afterwards that every module's go.mod and go.sum agree on v2.5.37. Tidy also drops accumulated unused entries (go-spew, pmezard/go-difflib, sergi/go-diff and similar test-only transitives), which accounts for the deletions outweighing the insertions. Not touched here: hugo/go.sum carries stale h1 lines for v2.5.33, v2.5.34 and v2.5.36 alongside the current v2.5.37. That is pre-existing on main, hugo is not part of this bump, and surplus go.sum entries are harmless -- only missing ones break a build. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4HsKKvk5TF1vypsJPqV76
patrick-hermann-sva
force-pushed
the
renovate/github.com-vektah-gqlparser-v2-2.x
branch
from
September 5, 2026 10:46
578dd36 to
9c471cd
Compare
github-actions Bot
pushed a commit
that referenced
this pull request
Sep 5, 2026
## [0.128.3](v0.128.2...v0.128.3) (2026-09-05) ### Bug Fixes * **deps:** update module github.com/vektah/gqlparser/v2 to v2.5.37 ([#306](#306)) ([767c88d](767c88d))
|
🎉 This PR is included in version 0.128.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
patrick-hermann-sva
added a commit
that referenced
this pull request
Sep 5, 2026
Renovate raised the whole opentelemetry-go monorepo, but the PR was broken in
two independent ways.
The reported one: the artifacts step failed, so no go.sum was updated and the
branch would have landed with go.mod and go.sum disagreeing across 28 modules.
`dagger functions` passed anyway, because `dagger develop` regenerates go.sum
inside the container -- CI green was never evidence the committed tree was
consistent.
The second is why this could not simply be rebased. Renovate also raised four
`replace` directives from v0.16.0 to v0.22.0:
replace go.opentelemetry.io/otel/log => go.opentelemetry.io/otel/log v0.22.0
replace go.opentelemetry.io/otel/sdk/log => ... v0.22.0
replace .../otlplog/otlploggrpc => ... v0.22.0
replace .../otlplog/otlploghttp => ... v0.22.0
Those are not stale versions. They are a deliberate pin written by the Dagger
SDK codegen, and github.com/dagger/otel-go v1.43.0 is built against them:
otel-go@v1.43.0/logging.go:47:63: undefined: log.KeyValue
otel-go@v1.43.0/transform.go:872:51: undefined: log.Value
v0.22.0 removed those types, so the bump fails to compile in every module that
imports the generated client -- which is all of them. Renovate cannot
distinguish a deliberate `replace` pin from an outdated dependency.
Isolated the two halves rather than assuming: with the core at v1.46.0 and the
replace directives left at v0.16.0, the tree builds. So the core bump is kept
and the pins are restored.
`renovate.json` now disables updates for those four packages, with the reason
recorded inline, so this PR does not get recreated.
Reapplied on top of #72 and #306 rather than rebased: those two touched the
same `require` blocks in all 28 go.mod files, and resolving 28 conflicts in
generated files by hand is not something to trust. The upstream change is
three direct requires plus four replace lines, so it was reapplied mechanically
and everything else regenerated. Verified gookit/validate v1.6.0 (#72) and
gqlparser v2.5.37 (#306) both survive.
Verified: `go mod tidy`, `go build` and `go vet` pass in all 28 modules.
`dagger functions` spot-checked on kcl, go, ansible, hugo and docker. `dagger
develop` on kcl leaves otel at v1.46.0 and the replaces at v0.16.0, so the fix
survives regeneration.
Note for the govulncheck backlog: grpc stays at v1.79.3 (indirect), so
GO-2026-6061 is not addressed here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A4HsKKvk5TF1vypsJPqV76
patrick-hermann-sva
added a commit
that referenced
this pull request
Sep 5, 2026
Renovate raised the whole opentelemetry-go monorepo, but the PR was broken in
two independent ways.
The reported one: the artifacts step failed, so no go.sum was updated and the
branch would have landed with go.mod and go.sum disagreeing across 28 modules.
`dagger functions` passed anyway, because `dagger develop` regenerates go.sum
inside the container -- CI green was never evidence the committed tree was
consistent.
The second is why this could not simply be rebased. Renovate also raised four
`replace` directives from v0.16.0 to v0.22.0:
replace go.opentelemetry.io/otel/log => go.opentelemetry.io/otel/log v0.22.0
replace go.opentelemetry.io/otel/sdk/log => ... v0.22.0
replace .../otlplog/otlploggrpc => ... v0.22.0
replace .../otlplog/otlploghttp => ... v0.22.0
Those are not stale versions. They are a deliberate pin written by the Dagger
SDK codegen, and github.com/dagger/otel-go v1.43.0 is built against them:
otel-go@v1.43.0/logging.go:47:63: undefined: log.KeyValue
otel-go@v1.43.0/transform.go:872:51: undefined: log.Value
v0.22.0 removed those types, so the bump fails to compile in every module that
imports the generated client -- which is all of them. Renovate cannot
distinguish a deliberate `replace` pin from an outdated dependency.
Isolated the two halves rather than assuming: with the core at v1.46.0 and the
replace directives left at v0.16.0, the tree builds. So the core bump is kept
and the pins are restored.
`renovate.json` now disables updates for those four packages, with the reason
recorded inline, so this PR does not get recreated.
Reapplied on top of #72 and #306 rather than rebased: those two touched the
same `require` blocks in all 28 go.mod files, and resolving 28 conflicts in
generated files by hand is not something to trust. The upstream change is
three direct requires plus four replace lines, so it was reapplied mechanically
and everything else regenerated. Verified gookit/validate v1.6.0 (#72) and
gqlparser v2.5.37 (#306) both survive.
Verified: `go mod tidy`, `go build` and `go vet` pass in all 28 modules.
`dagger functions` spot-checked on kcl, go, ansible, hugo and docker. `dagger
develop` on kcl leaves otel at v1.46.0 and the replaces at v0.16.0, so the fix
survives regeneration.
Note for the govulncheck backlog: grpc stays at v1.79.3 (indirect), so
GO-2026-6061 is not addressed here.
Claude-Session: https://claude.ai/code/session_01A4HsKKvk5TF1vypsJPqV76
Co-authored-by: Patrick Hermann <patrick.hermann@sva.de>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.5.33→v2.5.37Release Notes
vektah/gqlparser (github.com/vektah/gqlparser/v2)
v2.5.37Compare Source
Changelog
New Contributors
Full Changelog: vektah/gqlparser@v2.5.36...v2.5.37
Verifying this release
The SBOM is
gqlparser_2.5.37_source.tar.gz.sbom.json(SPDX-2.3).Released by GoReleaser.
v2.5.36Compare Source
What's Changed
New Contributors
Full Changelog: vektah/gqlparser@v2.5.35...v2.5.36
v2.5.35Compare Source
What's Changed
Full Changelog: vektah/gqlparser@v2.5.34...v2.5.35
v2.5.34Compare Source
What's Changed
New Contributors
Full Changelog: vektah/gqlparser@v2.5.33...v2.5.34
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.