chore(deps): bump go.opentelemetry.io/otel/sdk from 1.19.0 to 1.43.0 in /infra/feast-operator#6244
Conversation
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.19.0 to 1.43.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.19.0...v1.43.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>
| module github.com/feast-dev/feast/infra/feast-operator | ||
|
|
||
| go 1.22.9 | ||
| go 1.25.0 |
There was a problem hiding this comment.
🔴 go.mod requires Go 1.25.0 but Dockerfile uses Go 1.22.9 builder image
The go directive in go.mod was bumped from 1.22.9 to 1.25.0, but the Dockerfile at infra/feast-operator/Dockerfile:2 still uses registry.access.redhat.com/ubi9/go-toolset:1.22.9 as the builder image. Since Go 1.21+, the go directive acts as a minimum required version — Go 1.22.9 will refuse to build a module declaring go 1.25.0 (or attempt an automatic toolchain download that will likely fail in a container build). This will break all Docker image builds for the operator. Additionally, the CI workflows at .github/workflows/operator_pr.yml:17 and .github/workflows/operator-e2e-integration-tests.yml:55 both specify go-version: 1.22.9, which will similarly fail.
Prompt for agents
The go directive in infra/feast-operator/go.mod was changed from 1.22.9 to 1.25.0, but three other files still reference Go 1.22.9 and need to be updated to match:
1. infra/feast-operator/Dockerfile line 2: The builder image `registry.access.redhat.com/ubi9/go-toolset:1.22.9` needs to be changed to a Go 1.25.x image.
2. .github/workflows/operator_pr.yml line 17: `go-version: 1.22.9` needs to be updated to 1.25.0 (or a compatible version).
3. .github/workflows/operator-e2e-integration-tests.yml line 55: `go-version: 1.22.9` needs to be updated to 1.25.0 (or a compatible version).
Alternatively, if the Go 1.25.0 requirement is not intentional (e.g., it was auto-bumped by go mod tidy with a newer Go toolchain), consider reverting the go directive back to 1.22.9 or to whatever version the project infrastructure supports. Adding a `toolchain` directive (like the main go.mod has `toolchain go1.24.4`) could also help manage the version requirement more explicitly.
Was this helpful? React with 👍 or 👎 to provide feedback.
Bumps go.opentelemetry.io/otel/sdk from 1.19.0 to 1.43.0.
Release notes
Sourced from go.opentelemetry.io/otel/sdk's releases.
Changelog
Sourced from go.opentelemetry.io/otel/sdk's changelog.
... (truncated)
Commits
9276201Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)61b8c94chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)97a086echore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)5e363delimit response body size for OTLP HTTP exporters (#8108)35214b6Use an absolute path when calling bsd kenv (#8113)290024cfix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)e70658efix: support getBody in otelploghttp (#8096)4afe468fix(deps): update googleapis to 9d38bb4 (#8117)b9ca729chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)69472ecchore(deps): update fossas/fossa-action action to v1.9.0 (#8118)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.