chore(deps): update module github.com/googleapis/enterprise-certificate-proxy to v0.3.22

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/googleapis/enterprise-certificate-proxy	v0.3.6 → v0.3.22

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

googleapis/enterprise-certificate-proxy (github.com/googleapis/enterprise-certificate-proxy)

v0.3.22

Compare Source

What's Changed

• chore: update version.txt to 0.3.22 by @​nolanleastin in #​230

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.21...v0.3.22

v0.3.21

Compare Source

What's Changed

• feat: Add support for verbosity control for logging by @​agrawalradhika-cell in #​222
• fix: fix pkcs11 cert chain logic by @​arithmetic1728 in #​213
• chore: Bump version from v0.3.20 to v0.3.21 by @​arithmetic1728 in #​224
• chore: Set LogLevel off when ENABLE_ENTERPRISE_CERTIFICATE_LOGS is set to False/O by @​agrawalradhika-cell in #​225
• feat: Migrate from ServeMux to HandlerFunc to avoid collapsing // to / for http proxy in ECP by @​agrawalradhika-cell in #​226
• chore: Routing to readyzHandler only when the request is a local check by @​agrawalradhika-cell in #​228

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.20...v0.3.21

v0.3.20

Compare Source

What's Changed

• chore(deps): update actions/upload-artifact action to v7 by @​renovate-bot in #​156
• chore(deps): update actions/checkout action to v7 by @​renovate-bot in #​201
• build(deps): bump golang.org/x/crypto from 0.47.0 to 0.52.0 by @​dependabot[bot] in #​205
• chore(deps): update actions/setup-go action to v7 by @​renovate-bot in #​207
• Update CODEOWNERS by @​andyrzhao in #​218
• feat: Transition from localized logging to a robust, standardized logging utility across the entire ECP repository. by @​agrawalradhika-cell in #​217
• chore: Bump version from v0.3.19 to v0.3.20 by @​agrawalradhika-cell in #​221

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.19...v0.3.20

v0.3.19

Compare Source

What's Changed

• fix: use legacy OpenSSL algorithms for keychain import by @​nolanleastin in #​210
• chore: Update version.txt to 0.3.18 by @​nolanleastin in #​204
• fix: mTLS routing for hosts starting with 'mtls.' by @​nolanleastin in #​209
• chore: update go.mod toolchain to 1.26.5 by @​nolanleastin in #​212
• fix: serialize PKCS11 operations to resolve thread exhaustion by @​nolanleastin in #​211
• chore: update version.txt to v0.3.19 by @​nolanleastin in #​214

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.17...v0.3.19

v0.3.18

Compare Source

v0.3.17

Compare Source

What's Changed

• feat: Simplify mTLS filtering logic in ECP HTTP Proxy by @​nolanleastin in #​198
• chore: downgrade min Go version by @​ldez in #​199
• chore: Remove windows ECP DWARF debug symbols. by @​nolanleastin in #​203
• chore: Update version.txt to 0.3.17 by @​nolanleastin in #​202

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.16...v0.3.17

v0.3.16

Compare Source

What's Changed

• chore: Update go.mod to upgrade the go version to 1.25.8 by @​nolanleastin in #​193
• chore: Update version.txt to 0.3.16 by @​nolanleastin in #​194

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.15...v0.3.16

v0.3.15

Compare Source

What's Changed

• chore: Update version.txt to 0.3.15 by @​nolanleastin in #​192

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.14...v0.3.15

v0.3.14

Compare Source

What's Changed

• chore: Update main.go to increase proxyrequesttimeout by @​agrawalradhika-cell in #​187
• chore: Increase proxy request timeout for rsync gcloud fix by @​agrawalradhika-cell in #​188
• feat: Update version.txt to 0.3.14 by @​agrawalradhika-cell in #​189

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.13...v0.3.14

v0.3.13

Compare Source

What's Changed

• feat: support non-mtls requests as well by @​sai-sunder-s in #​185
• feat: Update version.txt to 0.3.12 by @​agrawalradhika-cell in #​183
• feat: Update version.txt to 0.3.13 by @​agrawalradhika-cell in #​186

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.12...v0.3.13

v0.3.12

Compare Source

What's Changed

• chore: Update go.mod to upgrade the go version to 1.24.11 by @​agrawalradhika-cell in #​180

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.11...v0.3.12

v0.3.11

Compare Source

What's Changed

• chore: Update version.txt to v0.3.11 by @​agrawalradhika-cell in #​176
• chore: Update logging in http_proxy to be enabled via ENABLE_ENTERPRSE_CERTIFICATE_LOGS by @​agrawalradhika-cell in #​175
• feat: Update CODEOWNERS to add Radhika and Nolan to ECP code by @​agrawalradhika-cell in #​166
• build(deps): bump golang.org/x/crypto from 0.35.0 to 0.45.0 by @​dependabot[bot] in #​161
• chore(deps): update dependency go to 1.25 by @​renovate-bot in #​144
• fix(deps): update module golang.org/x/sys to v0.40.0 by @​renovate-bot in #​145
• fix(deps): update module golang.org/x/crypto to v0.47.0 by @​renovate-bot in #​177

New Contributors

• @​dependabot[bot] made their first contribution in #​161

Full Changelog: googleapis/enterprise-certificate-proxy@0.3.10...v0.3.11

v0.3.9

Compare Source

What's Changed

• Revert "feat: Add logging for ECP such that it is enabled/disabled using ENABLE_ENTERPRISE_CERTIFICATE_LOGS flag" by @​agrawalradhika-cell in #​168
• chore: Remove logging from http_proxy to reduce noise for customers, will add them back later. by @​agrawalradhika-cell in #​169

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.8...v0.3.9

v0.3.8

Compare Source

What's Changed

• feat: Add logging for ECP such that it is enabled/disabled using ENABLE_ENTERPRISE_CERTIFICATE_LOGS flag by @​agrawalradhika-cell in #​164
• chore: Update version.txt to update version to v0.3.8 by @​agrawalradhika-cell in #​167

New Contributors

• @​agrawalradhika-cell made their first contribution in #​164

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.7...v0.3.8

v0.3.7

Compare Source

This release creates ECP Http Proxy

What's Changed

• fix: Address ImportPKCS12Cred failing tests by @​nolanleastin in #​155
• feat(http_proxy): Implement a local HTTP Proxy Server that integrates with ECP by @​nolanleastin in #​154
• build(ecp-http-proxy): build scripts generate ecp_http_proxy binary by @​nolanleastin in #​157
• feat(ecp-http-proxy): add /readyz endpoint to proxy server by @​nolanleastin in #​158
• chore: Update version.txt to 0.3.7 by @​nolanleastin in #​159

New Contributors

• @​nolanleastin made their first contribution in #​155

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.6...v0.3.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/go.sum

Command failed: go get -t ./...
go: downloading github.com/sirupsen/logrus v1.9.3
go: downloading github.com/spf13/viper v1.8.1
go: downloading github.com/stretchr/testify v1.10.0
go: downloading github.com/cockroachdb/errors v1.11.1
go: downloading github.com/spf13/cobra v1.5.0
go: downloading github.com/spf13/cast v1.5.1
go: downloading gorm.io/gorm v1.25.5
go: downloading github.com/go-playground/validator/v10 v10.20.0
go: downloading github.com/go-sql-driver/mysql v1.7.1
go: downloading github.com/viant/afs v1.16.0
go: downloading gorm.io/driver/mysql v1.5.1
go: downloading gorm.io/driver/postgres v1.5.2
go: downloading github.com/magiconair/properties v1.8.5
go: downloading github.com/merico-ai/graphql v0.0.0-20260206020408-b7fd267bcfac
go: downloading github.com/mitchellh/mapstructure v1.5.0
go: downloading github.com/panjf2000/ants/v2 v2.4.6
go: downloading golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0
go: downloading cloud.google.com/go/storage v1.52.0
go: downloading cloud.google.com/go v0.121.0
go: downloading github.com/coreos/go-oidc/v3 v3.9.0
go: downloading google.golang.org/api v0.230.0
go: downloading github.com/gin-gonic/gin v1.9.1
go: downloading github.com/golang-jwt/jwt/v5 v5.2.2
go: downloading golang.org/x/oauth2 v0.30.0
go: downloading golang.org/x/sync v0.20.0
go: downloading github.com/rogpeppe/go-internal v1.13.1
go: downloading gorm.io/datatypes v1.0.1
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/tidwall/gjson v1.14.3
go: downloading github.com/fsnotify/fsnotify v1.4.9
go: downloading github.com/hashicorp/hcl v1.0.0
go: downloading github.com/pelletier/go-toml v1.9.3
go: downloading github.com/spf13/afero v1.10.0
go: downloading github.com/spf13/jwalterweatherman v1.1.0
go: downloading github.com/spf13/pflag v1.0.5
go: downloading github.com/subosito/gotenv v1.2.0
go: downloading gopkg.in/ini.v1 v1.67.0
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading golang.org/x/sys v0.45.0
go: downloading github.com/chainguard-dev/git-urls v1.0.2
go: downloading github.com/libgit2/git2go/v33 v33.0.6
go: downloading github.com/go-git/go-git/v5 v5.12.0
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading golang.org/x/mod v0.35.0
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/snowflakedb/gosnowflake v1.19.1
go: downloading github.com/inconshreveable/mousetrap v1.0.0
go: downloading github.com/gocarina/gocsv v0.0.0-20220707092902-b9da1f06c77e
go: downloading github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b
go: downloading github.com/cockroachdb/redact v1.1.5
go: downloading github.com/getsentry/sentry-go v0.18.0
go: downloading github.com/jinzhu/now v1.1.5
go: downloading github.com/gabriel-vasile/mimetype v1.4.7
go: downloading github.com/go-playground/universal-translator v0.18.1
go: downloading github.com/leodido/go-urn v1.4.0
go: downloading golang.org/x/crypto v0.52.0
go: downloading golang.org/x/text v0.37.0
go: downloading github.com/jackc/pgx/v5 v5.6.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/aws/aws-sdk-go v1.55.6
go: downloading github.com/jinzhu/inflection v1.0.0
go: downloading golang.org/x/net v0.54.0
go: downloading cloud.google.com/go/compute/metadata v0.6.0
go: downloading cloud.google.com/go/iam v1.5.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/googleapis/gax-go/v2 v2.14.1
go: downloading go.opentelemetry.io/contrib/detectors/gcp v1.35.0
go: downloading go.opentelemetry.io/otel v1.37.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.35.0
go: downloading go.opentelemetry.io/otel/sdk v1.35.0
go: downloading go.opentelemetry.io/otel/trace v1.37.0
go: downloading google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb
go: downloading google.golang.org/grpc v1.73.0
go: downloading google.golang.org/protobuf v1.36.6
go: downloading github.com/gin-contrib/sse v0.1.0
go: downloading github.com/go-jose/go-jose/v3 v3.0.1
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading cloud.google.com/go/auth v0.16.0
go: downloading github.com/lib/pq v1.10.2
go: downloading github.com/tidwall/match v1.1.1
go: downloading github.com/tidwall/pretty v1.2.0
go: downloading github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20260708090559-a0c568e41e08
go: downloading github.com/gin-contrib/cors v1.7.2
go: downloading github.com/swaggo/files v1.0.1
go: downloading github.com/swaggo/gin-swagger v1.6.0
go: downloading github.com/swaggo/swag v1.16.1
go: downloading github.com/robfig/cron/v3 v3.0.0
go: downloading golang.org/x/tools v0.44.0
go: downloading dario.cat/mergo v1.0.0
go: downloading github.com/ProtonMail/go-crypto v1.0.0
go: downloading github.com/go-git/go-billy/v5 v5.5.0
go: downloading github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
go: downloading github.com/emirpasic/gods v1.18.1
go: downloading github.com/gogo/protobuf v1.3.2
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/go-playground/locales v0.14.1
go: downloading github.com/99designs/keyring v1.2.2
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.4.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0
go: downloading github.com/BurntSushi/toml v1.4.0
go: downloading github.com/apache/arrow-go/v18 v18.4.0
go: downloading github.com/aws/aws-sdk-go-v2 v1.38.1
go: downloading github.com/aws/aws-sdk-go-v2/config v1.27.11
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.17.11
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1
go: downloading github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15
go: downloading github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.28.6
go: downloading github.com/aws/smithy-go v1.22.5
go: downloading github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8
go: downloading github.com/jackc/pgpassfile v1.0.0
go: downloading github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a
go: downloading github.com/go-errors/errors v1.4.2
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20250414145226-207652e42e2e
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20250425173222-7b384671a197
go: downloading cloud.google.com/go/monitoring v1.24.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0
go: downloading github.com/go-logr/logr v1.4.3
go: downloading go.opentelemetry.io/otel/metric v1.37.0
go: downloading cloud.google.com/go/auth/oauth2adapt v0.2.8
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0
go: downloading github.com/pelletier/go-toml/v2 v2.2.1
go: downloading github.com/ugorji/go/codec v1.2.12
go: downloading github.com/bytedance/sonic v1.11.6
go: downloading github.com/goccy/go-json v0.10.5
go: downloading github.com/json-iterator/go v1.1.12
go: downloading github.com/google/s2a-go v0.1.9
go: downloading github.com/KyleBanks/depth v1.2.1
go: downloading github.com/go-openapi/spec v0.20.4
go: downloading github.com/pjbgf/sha1cd v0.3.0
go: downloading github.com/cyphar/filepath-securejoin v0.2.4
go: downloading github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
go: downloading github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4
go: downloading github.com/danieljoos/wincred v1.2.2
go: downloading github.com/dvsekhvalnov/jose2go v1.7.0
go: downloading github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2
go: downloading github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c
go: downloading github.com/mtibben/percent v0.2.1
go: downloading golang.org/x/term v0.43.0
go: downloading golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
go: downloading github.com/google/flatbuffers v25.2.10+incompatible
go: downloading github.com/klauspost/compress v1.18.0
go: downloading github.com/pierrec/lz4/v4 v4.1.22
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.20.5
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7
go: downloading github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2
go: downloading github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5
go: downloading github.com/jackc/puddle/v2 v2.2.1
go: downloading github.com/jmespath/go-jmespath v0.4.0
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0
go: downloading golang.org/x/time v0.11.0
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.1.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.22
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.32.4
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.2
go: downloading github.com/go-openapi/jsonpointer v0.19.5
go: downloading github.com/go-openapi/jsonreference v0.19.6
go: downloading github.com/go-openapi/swag v0.19.15
go: downloading github.com/cloudflare/circl v1.3.7
go: downloading gopkg.in/warnings.v0 v0.1.2
go: downloading github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
go: downloading github.com/kevinburke/ssh_config v1.2.0
go: downloading github.com/skeema/knownhosts v1.2.2
go: downloading github.com/xanzy/ssh-agent v0.3.3
go: downloading github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2
go: downloading golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa
go: downloading github.com/zeebo/xxh3 v1.0.2
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5
go: downloading github.com/spiffe/go-spiffe/v2 v2.5.0
go: downloading github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f
go: downloading github.com/envoyproxy/protoc-gen-validate v1.2.1
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/PuerkitoBio/purell v1.1.1
go: downloading github.com/mailru/easyjson v0.7.7
go: downloading golang.org/x/arch v0.7.0
go: downloading github.com/cloudwego/base64x v0.1.4
go: downloading github.com/Microsoft/go-winio v0.6.2
go: downloading github.com/apache/thrift v0.22.0
go: downloading github.com/klauspost/cpuid/v2 v2.2.11
go: downloading github.com/go-jose/go-jose/v4 v4.0.5
go: downloading github.com/zeebo/errs v1.4.0
go: downloading cel.dev/expr v0.23.0
go: downloading github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578
go: downloading github.com/josharian/intern v1.0.0
go: downloading github.com/bytedance/sonic/loader v0.1.1
go: downloading github.com/twitchyliquid64/golang-asm v0.15.1
go: downloading github.com/klauspost/asmfmt v1.3.2
go: downloading github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8
go: downloading github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3
go: downloading github.com/andybalholm/brotli v1.2.0
go: downloading github.com/golang/snappy v1.0.0
go: downloading github.com/cloudwego/iasm v0.2.0
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/context: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/context
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/dal: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/dal
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/log: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/log
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/plugin: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/plugin
go: github.com/apache/incubator-devlake/helpers/pluginhelper/api tested by
	github.com/apache/incubator-devlake/helpers/pluginhelper/api.test imports
	github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api: cannot find module providing package github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api
go: module github.com/aws/aws-sdk-go is deprecated: aws-sdk-go is deprecated. Use aws-sdk-go-v2.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:17 PM UTC · Completed 10:23 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

Looks good to me

Previous run

Review

Findings

Medium

• [missing artifact] backend/go.sum — The go.mod dependency was bumped from v0.3.6 to v0.3.21 but go.sum is not updated in this PR. The base-branch go.sum contains checksum entries only for v0.3.6. Without adding the v0.3.21 checksums, go mod verify and go build will fail.
  Remediation: Run go mod tidy in the backend/ directory and include the resulting go.sum changes in this PR.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Looks good to me

Previous run (3)

Looks good to me

Previous run (4)

Review — comment

PR: #39 — chore(deps): update module github.com/googleapis/enterprise-certificate-proxy to v0.3.18
Author: red-hat-konflux[bot] (automated dependency update)
Scope: 1 file changed (backend/go.mod), 1 addition, 1 deletion

Summary

This PR updates the indirect dependency github.com/googleapis/enterprise-certificate-proxy from v0.3.6 to v0.3.18 in backend/go.mod. The library handles enterprise certificate and mTLS integration for Google Cloud client libraries.

The upstream releases between v0.3.6 and v0.3.18 include maintenance improvements (Go version upgrades, build optimizations, mTLS filtering simplification, HTTP proxy features) and dependency bumps (notably golang.org/x/crypto updates). No breaking changes were noted in the upstream release notes.

Findings

#	Severity	Category	File	Description
1	medium	correctness	backend/go.mod	Missing go.sum update

1. Missing go.sum update (medium)

File: backend/go.mod, line 144

The PR updates the dependency version in go.mod but does not include the corresponding go.sum changes. The current go.sum contains checksums only for v0.3.6. Go module verification requires matching checksums in go.sum for all dependencies referenced in go.mod. Without the update, go build will fail with:

go: github.com/googleapis/enterprise-certificate-proxy@v0.3.18: missing go.sum entry

Remediation: Run cd backend && go mod tidy and commit the updated go.sum.

Notes

• The dependency is // indirect — no first-party code directly imports it.
• The upstream library is Google-maintained; the 0.3.x version series indicates backward compatibility.
• Transitive update to golang.org/x/crypto is a positive security hygiene improvement.

Previous run (5)

Review — comment

PR: chore(deps): update enterprise-certificate-proxy v0.3.2 → v0.3.18

Summary

This is an automated indirect dependency bump from red-hat-konflux[bot]. The change is a single-line version update in backend/go.mod for github.com/googleapis/enterprise-certificate-proxy, a Google library used transitively by Google Cloud client libraries. No first-party Go code directly imports this package.

The dependency update itself is safe — this is a patch-level progression on a well-maintained Google library with no known security implications for the old version.

Findings

⚠ Missing go.sum update — medium

File: backend/go.sum

backend/go.sum contains checksums for v0.3.2 but is not updated with checksums for v0.3.18. Since Go 1.16+, the default module mode is -mod=readonly when go.sum exists, which means:

• go build, go test, and golangci-lint will fail because the v0.3.18 checksums are missing
• The CI cache key in .github/workflows/test.yml (line 64) uses hashFiles('**/go.sum'), so a stale go.sum will also produce incorrect cache hits
• Neither the GitHub Actions workflows nor the Tekton pipeline nor the backend Makefile runs go mod tidy before building

Remediation:

cd backend && go mod tidy

Commit the updated go.sum alongside go.mod.

---

This is a first review. No prior review to anchor against.

Previous run (6)

Review — comment

PR: #39 — chore(deps): update module github.com/googleapis/enterprise-certificate-proxy to v0.3.18
Author: red-hat-konflux[bot] (MintMaker/Renovate)
Scope: 1 file changed (backend/go.mod), indirect dependency bump v0.3.2 → v0.3.18

Summary

This PR updates the indirect Go dependency github.com/googleapis/enterprise-certificate-proxy from v0.3.2 to v0.3.18 in backend/go.mod. The upstream changelog across these 16 patch releases consists of maintenance work (Go version bumps, CI fixes, dependency updates), minor features (keychain type selection on macOS, HTTP proxy server, mTLS filtering simplification), and no security advisories. The dependency is indirect and the version bump stays within the v0.3.x line, so API compatibility risk is negligible.

Findings

1. go.sum not updated — backend/go.sum · medium · correctness

The PR updates the version in go.mod but does not update go.sum. The go.sum file currently contains checksums only for v0.3.2:

github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=

Without corresponding checksums for v0.3.18, go build, go mod verify, and go mod tidy will fail with a checksum mismatch or missing entry error.

Remediation: Run cd backend && go mod tidy and commit the updated go.sum.

Verdict

One medium-severity finding (missing go.sum update). The dependency bump itself is safe and low-risk. The go.sum gap should be resolved before merge to avoid build failures.

Previous run (7)

Review

Findings

Medium

• [api-contract] backend/go.mod:95 — go.mod is updated to require enterprise-certificate-proxy v0.3.17, but go.sum still only contains hashes for v0.3.2. The Go toolchain will refuse to build because the required module version has no matching checksum entry in go.sum.
  Remediation: Run go mod tidy in the backend/ directory and commit the resulting changes to both go.mod and go.sum.

Previous run (8)

Review

Findings

High

• [API contract violation] backend/go.sum:277 — go.mod is updated to require enterprise-certificate-proxy v0.3.17, but go.sum still contains checksums only for v0.3.2 (lines 277-278). No checksums for v0.3.17 exist in go.sum. Running go build or go mod verify will fail because the checksum for v0.3.17 is missing.
  Remediation: Run go mod tidy in the backend/ directory and commit the updated go.sum alongside go.mod.

Previous run (9)

Review

Findings

High

• [API contract violations] backend/go.mod:95 — go.mod bumps enterprise-certificate-proxy to v0.3.17 but go.sum is not included in the PR. The existing go.sum contains checksum entries only for v0.3.2. The Go toolchain requires go.sum entries to match go.mod; builds and go mod verify will fail because the required v0.3.17 checksum entries are absent from go.sum.
  Remediation: Run go mod tidy (or go mod download) in the backend/ directory and include the updated go.sum in the PR.

Previous run (10)

Review

Findings

High

• [error handling gaps] backend/go.sum:277 — go.sum is not updated to match the new dependency version. go.mod declares enterprise-certificate-proxy v0.3.16, but go.sum still contains checksums only for v0.3.2 (lines 277–278). Running go build or go mod verify will fail because the checksum for v0.3.16 is missing from go.sum.
  Remediation: Run go mod tidy (or go mod download) in the backend/ directory to update go.sum with the correct checksums for v0.3.16.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:49 PM UTC · Completed 9:55 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 5:34 AM UTC · Completed 5:40 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-retro]

Retro: PR #39 — Renovate dependency bump autoclosed without merge

What happened: MintMaker/Renovate opened PR #39 on 2025-12-24 to bump enterprise-certificate-proxy in backend/go.mod. Renovate itself immediately reported that go.sum could not be updated (artifact failure due to missing mock packages). The PR sat dormant for ~6 months. When the review agent ran (2026-06-25), it correctly identified the missing go.sum update as a HIGH-severity build-breaking issue and requested changes. The review agent ran a second time (2026-06-26) on the same commit (ec21706), producing the same finding. No fix agent was dispatched. The PR was autoclosed on 2026-06-28.

Review quality: Good. The review agent correctly caught the real issue — go.mod was updated but go.sum was not, which would break builds.

Waste identified:

1. Duplicate review on the same HEAD SHA (2 reviews, same finding) — covered by #1452
2. Fix agent never dispatched despite CHANGES_REQUESTED on a bot PR — covered by #2596 and possibly #2462
3. Retro dispatched on autoclosed bot PR with no agent code involvement — covered by #2461
4. Review didn't consult Renovate's own failure comment which already explained the problem — covered by #1406
5. Review could have recommended closing the unfixable PR — covered by #2586

No new proposals filed. All identified improvements are already tracked in open issues on fullsend-ai/fullsend. The existing backlog comprehensively covers the patterns observed here.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:02 AM UTC · Completed 9:08 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 6:38 PM UTC · Completed 6:46 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-retro]

Retro: PR #39 — Duplicate retro on autoclosed bot dependency PR

PR #39 was a MintMaker/Renovate bot PR to bump enterprise-certificate-proxy in backend/go.mod. Renovate failed to update go.sum (missing mock packages), so the PR was broken from the start. It sat open for ~6 months, received 3 review agent runs all flagging the same go.sum mismatch, no fix agent was dispatched, and the PR was autoclosed on 2026-06-29.

A previous retro already ran on this PR (2026-06-28, run 28312625861) and thoroughly identified all improvement opportunities. All 6 findings from that retro are tracked in open issues:

Issue	Topic
#1452	Deduplicate review dispatches for same HEAD SHA
#2596	Auto-dispatch fix agent on critical findings for bot PRs
#2462	Fix agent dispatch name-matching bug
#2461	Skip retro dispatch for autoclosed bot PRs
#2586	Review agent should recommend closing unfixable bot PRs
#1406	Review agent should weigh bot warning comments

This current retro run is itself an instance of the duplicate retro problem tracked in #2401 and #2461. No new proposals — all improvements are already tracked.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:42 PM UTC · Completed 9:49 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:48 AM UTC · Completed 1:52 AM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:58 AM UTC · Completed 2:02 AM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-retro]

PR #39 is a MintMaker/Renovate bot PR opened 2025-12-24 to bump enterprise-certificate-proxy v0.3.2 → v0.3.18 in backend/go.mod. Renovate reported an artifact failure (go.sum could not be updated) on 2025-12-28. The PR sat broken for ~6 months, then accumulated 5 review agent runs (all flagging the same go.sum mismatch) and 3 retro runs (including this one), with zero human engagement, before being autoclosed on 2026-07-08. Two prior retros (2026-06-28, 2026-06-29) thoroughly analyzed this workflow and identified all improvement opportunities; every finding maps to an existing open issue on fullsend-ai/fullsend. This third retro run is itself an instance of the duplicate retro problem tracked in apache#2401 and apache#2461. Total waste: 8 agent runs producing zero actionable outcomes on a PR that was broken from inception. No new proposals — all improvements are already tracked.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:25 AM UTC · Completed 5:31 AM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:35 PM UTC · Completed 8:40 PM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:27 PM UTC · Completed 9:33 PM UTC
Commit: 37b10e4 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:09 AM UTC · Completed 10:15 AM UTC
Commit: 701e62a · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:18 AM UTC · Completed 3:29 AM UTC

Commit: e515ef1 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.19

[fullsend-ai-review]

Risk Assessment: low (1/5)

Details

Single-file dependency bump (go.mod, 2 lines) by a bot with no protected paths, no security-sensitive files, and no CI changes yields a Tier 1 composite of 1.25; low git churn and stable history bring the Tier 2 composite to 1.86, producing a weighted composite of ~1.5 that rounds to 1 (low).

Previous run

Risk Assessment: moderate (2/5)

Details

Bot-authored single-file dependency bump with minimal metadata risk (Tier 1 = 1.25), slightly elevated by go.mod's prior revert history and two distinct recent contributors in the Tier 2 analysis, yielding a composite of ~1.54 rounded to 2 (moderate).

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:32 AM UTC · Completed 1:42 AM UTC

Commit: 0f055a8 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.81