Repository navigation
deps: bump github.com/compose-spec/compose-go/v2 from 2.14.0 to 2.16.2 - #142
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Bumps [github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go) from 2.14.0 to 2.16.2. - [Release notes](https://github.com/compose-spec/compose-go/releases) - [Commits](compose-spec/compose-go@v2.14.0...v2.16.2) --- updated-dependencies: - dependency-name: github.com/compose-spec/compose-go/v2 dependency-version: 2.16.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
4541662 to
16dead2
Compare
![dap-code-review-by-crunchloop[bot]](https://avatars.githubusercontent.com/in/4707266?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review — 16dead2 · BLOCKING
The compose-go API bump introduces a compile-time incompatibility in the native compose package, blocking builds of the project and downstream consumers.
| Finding | Anchor | |
|---|---|---|
| 🟠 HIGH | The compose-go bump leaves the native compose package uncompilable core/version-compatibility |
go.mod:6 |
What I reviewed
Coverage: Reviewed commit 16dead2303f5cc73ae2e43632b7e13f02f71624b (1 commit; 2 files: go.mod, go.sum) against the repository engineering guidance at base SHA a4e72d2a108d81ab72539c17fcd8483acb384d7e; .dap/code-review.yml is absent. Checked the changed dependency API against native compose consumers and the old dependency declaration. The dependency-only scope otherwise has no additional surfaced behavior to assess; broader runtime and integration behavior was not reached. version-compatibility, interface-contract, and correctness were applicable; lifecycle, state-integrity, security, and other unrelated mechanisms were not in scope.
BLOCKING — at least one finding is at or above this repository's blocking severity. Reply in a finding's own thread to argue it. On the pull request I answer @dap-code-review-by-crunchloop review, pause and resume.
|
|
||
| require ( | ||
| github.com/compose-spec/compose-go/v2 v2.14.0 | ||
| github.com/compose-spec/compose-go/v2 v2.16.2 |
There was a problem hiding this comment.
🟠 HIGH · core/version-compatibility
The compose-go bump leaves the native compose package uncompilable
compose/plan.go:213-215 consumes the changed ServiceConfig.PreStart field by assigning it to hooks []composetypes.ServiceHook; the updated compose-go definition at /tmp/compose-go-v2.16.2/types/types.go:157 makes those slice types incompatible. The same stale assignment occurs in pre_start test fixtures.
Fix — Update pre_start handling and fixtures to use compose-go's PreStartHook type, or handle pre_start separately while preserving validation of all three hook fields.
Witness
Commands and raw output:
git show HEAD:compose/plan.go | sed -n '209,218p'
func unsupportedHooks(service string, svc composetypes.ServiceConfig) []UnsupportedField {
var out []UnsupportedField
for _, h := range []struct {
field string
hooks []composetypes.ServiceHook
}{
{"pre_start", svc.PreStart},
{"post_start", svc.PostStart},
{"pre_stop", svc.PreStop},
sed -n '157,159p' /tmp/compose-go-v2.16.2/types/types.go
PreStart []PreStartHook `yaml:"pre_start,omitempty" json:"pre_start,omitempty"`
PostStart []ServiceHook `yaml:"post_start,omitempty" json:"post_start,omitempty"`
PreStop []ServiceHook `yaml:"pre_stop,omitempty" json:"pre_stop,omitempty"`
grep -nE 'PreStart|ServiceHook' /tmp/compose-go-v2.14.0/types/types.go
141: PreStart []ServiceHook `yaml:"pre_start,omitempty" json:"pre_start,omitempty"`
142: PostStart []ServiceHook `yaml:"post_start,omitempty" json:"post_start,omitempty"`
143: PreStop []ServiceHook `yaml:"pre_stop,omitempty" json:"pre_stop,omitempty"`
The new dependency changes ServiceConfig.PreStart from []ServiceHook to []PreStartHook, but unsupportedHooks still places it into a []ServiceHook field. Go rejects this assignment, so the package (and consumers building it) cannot compile after this dependency bump. The related tests also construct PreStart with []ServiceHook (for example compose/plan_test.go:207 and compose/orchestrator_test.go:1324), independently breaking test compilation.
Bumps github.com/compose-spec/compose-go/v2 from 2.14.0 to 2.16.2.
Release notes
Sourced from github.com/compose-spec/compose-go/v2's releases.
... (truncated)
Commits
ddbe099feat: add the umask service attribute5515644types: add ServiceNameAliasEnabled helper on ServiceNetworkConfig3aaa230types: add use_service_name_alias to service networks79c7069chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.208a1af1chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2bd828eatypes: resolve the labels of pre_start hooksc53b350types: resolve the environment of pre_start hooks32d8d5doverride: share the by-key compaction and reject null ipam config items7ed4d72override: pin the merge of KEY=VALUE entries that are not interpolatedbe0aa2foverride: compact repeated keys and keep empty lists in KEY=VALUE merge