Update deps to latest stable #45
Conversation
📝 WalkthroughWalkthroughThis PR updates CI workflows, Dagger engine and binaries, Go module dependencies, and several tool/version constants; README roadmap entry marked complete. No control-flow or public API signature changes. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Hold Varnish at v7 until v8 becomes more mature. By the way things are going, we are most likely going to wait until the Vynil rename completes, and then we roll out that new major version in parallel. Signed-off-by: Gerhard Lazu <[email protected]>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
dagger/go.sumis excluded by!**/*.sum
📒 Files selected for processing (8)
.github/workflows/_github.yml.github/workflows/_namespace.ymlREADME.mddagger.jsondagger/go.moddagger/main.gojust/dagger.justjust/hurl.just
🧰 Additional context used
🧠 Learnings (4)
📓 Common learnings
Learnt from: gerhard
Repo: thechangelog/pipely PR: 18
File: dagger/main.go:292-304
Timestamp: 2025-07-03T08:51:11.320Z
Learning: When Go tools in dagger/main.go are pinned to specific commit hashes rather than release tags, this is intentional to access newer changes not yet included in releases. Avoid suggesting updates to release tags when commits are used, as the commits likely contain important unreleased features or fixes.
📚 Learning: 2025-07-03T08:51:11.320Z
Learnt from: gerhard
Repo: thechangelog/pipely PR: 18
File: dagger/main.go:292-304
Timestamp: 2025-07-03T08:51:11.320Z
Learning: When Go tools in dagger/main.go are pinned to specific commit hashes rather than release tags, this is intentional to access newer changes not yet included in releases. Avoid suggesting updates to release tags when commits are used, as the commits likely contain important unreleased features or fixes.
Applied to files:
dagger.jsondagger/go.modjust/dagger.justdagger/main.go
📚 Learning: 2025-12-30T13:45:37.201Z
Learnt from: gerhard
Repo: thechangelog/pipely PR: 44
File: just/hurl.just:13-17
Timestamp: 2025-12-30T13:45:37.201Z
Learning: In Pipely's Justfiles, avoid defining color variables (GREEN, NORMAL, MAGENTA, BOLD, WHITE, CYAN, YELLOW, BLUE). Rely on Just's default color handling so output remains uncolored when colors aren’t defined. Do not hardcode empty strings or override defaults; let the tool manage color defaults for consistent behavior across Justfiles.
Applied to files:
just/hurl.justjust/dagger.just
📚 Learning: 2025-12-30T17:03:18.040Z
Learnt from: gerhard
Repo: thechangelog/pipely PR: 44
File: just/fly.just:94-98
Timestamp: 2025-12-30T17:03:18.040Z
Learning: In Fly.io deployments, create volumes only in the primary region and do not duplicate volume creation across multiple regions. Do not rely on regional replication for volumes. If you need global configuration, set environment variables (e.g., VARNISH_FILE_SIZE) once in a global scope so they apply to all machines, rather than per-region or per-instance.
Applied to files:
just/hurl.justjust/dagger.just
🪛 actionlint (1.7.9)
.github/workflows/_namespace.yml
17-17: label "namespace-experiments:dagger.integration=enabled;dagger.version=0.19.8" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🔇 Additional comments (14)
.github/workflows/_namespace.yml (2)
17-17: LGTM! Dagger version is consistent.The Dagger version update to 0.19.8 aligns with
just/dagger.justanddagger.json.Note: The actionlint warning about the unknown label is a false positive—
namespace-experiments:dagger.integration=enabled;dagger.version=0.19.8is a valid custom label for namespace.so runners.
22-24: LGTM! Action versions are consistent.The setup-just and just-version updates match those in
.github/workflows/_github.yml.dagger/main.go (4)
28-28: LGTM! Hurl version is consistent.The Hurl version bump to 7.1.0 aligns with
just/hurl.just.
31-31: Oha version 1.12.1 is valid. The version bump from 1.10.0 to 1.12.1 is appropriate and the release exists on GitHub.
15-16: LGTM. The Golang version bump from 1.24.9 to 1.25.5 and the sha256 hash for linux/amd64 are both correct.
73-73: Unable to verify the Varnish image hash with available tools. The hash format is valid and version 7.7.3 matches project objectives (intentionally held at v7), but the sha256 digest requires either runningdocker pull varnish:7.7.3locally or querying the Docker registry API to confirm it matches the official image. Verify via:docker pull varnish:7.7.3 && docker image inspect --format='{{index .RepoDigests 0}}' varnish:7.7.3README.md (1)
20-20: LGTM! Documentation updated appropriately.The roadmap item has been marked complete with a reference to this PR, accurately reflecting the dependency updates while noting the Varnish version hold at v7.7.3.
dagger.json (3)
3-3: LGTM! Engine version is consistent.The Dagger engine version update to v0.19.8 aligns with
just/dagger.justand.github/workflows/_namespace.yml.
10-10: Flyio dependency updated to @main branch.The commit
3cb1cd957782f7b841f6fc49a662073180021a29is valid and present in the repository, confirming the intentional update to reference the main branch for access to unreleased changes.
15-15: This is standard Dagger v0.19.x backwards-compatibility configuration.The
disableDefaultFunctionCachingflag is auto-generated bydagger developand preserves the legacy session caching behavior for functions. It can be removed once functions are explicitly annotated with desired cache policies. No action needed unless intentionally migrating to per-function caching.just/hurl.just (1)
4-4: Version alignment and existence verified.Hurl version 7.1.0 exists and is the latest stable release (released Nov 26, 2025). The version correctly aligns with
hurlVersionindagger/main.go.dagger/go.mod (1)
6-25: LGTM. Compatibility verified.gqlgen v0.17.81 is confirmed compatible with gqlparser v2.5.30. OpenTelemetry v1.38.0 has minimal breaking changes; the Kubernetes semantic convention metric renaming (k8s.node.allocatable.* → k8s.node.*.allocatable) only affects code explicitly using those metrics. Project targets Go 1.24.0, satisfying OTel v1.38.0's requirement.
just/dagger.just (1)
4-4: LGTM! Dagger version 0.19.8 exists and was released on Dec 4–5, 2025. The version bump aligns with updates across the PR..github/workflows/_github.yml (1)
16-20: All versions are available and appropriate.actions/checkout@v5 is an official stable release using node24 runtime (requires GitHub Actions Runner v2.327.1+). extractions/setup-just@v3 is a community action properly documented for installing just. Just version 1.45.0 is available (released Dec 10, 2025) with recent improvements.
gerhard
force-pushed
the
update-deps-to-latest-stable
branch
from
0840fed to
1eeea7e
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
dagger/go.sumis excluded by!**/*.sum
📒 Files selected for processing (8)
.github/workflows/_github.yml.github/workflows/_namespace.ymlREADME.mddagger.jsondagger/go.moddagger/main.gojust/dagger.justjust/hurl.just
🚧 Files skipped from review as they are similar to previous changes (3)
- README.md
- dagger/main.go
- just/hurl.just
🧰 Additional context used
🧠 Learnings (5)
📓 Common learnings
Learnt from: gerhard
Repo: thechangelog/pipely PR: 45
File: dagger/go.mod:3-3
Timestamp: 2025-12-30T18:06:40.932Z
Learning: In the thechangelog/pipely repository, the go.mod file in the dagger/ directory (dagger/go.mod) is for Dagger's internal module. The Go version directive in this file is managed by Dagger itself, and compatibility/breaking change analysis for Go version updates in this file is not necessary since Dagger handles its own runtime compatibility.
Learnt from: gerhard
Repo: thechangelog/pipely PR: 18
File: dagger/main.go:292-304
Timestamp: 2025-07-03T08:51:11.320Z
Learning: When Go tools in dagger/main.go are pinned to specific commit hashes rather than release tags, this is intentional to access newer changes not yet included in releases. Avoid suggesting updates to release tags when commits are used, as the commits likely contain important unreleased features or fixes.
📚 Learning: 2025-12-30T18:06:40.932Z
Learnt from: gerhard
Repo: thechangelog/pipely PR: 45
File: dagger/go.mod:3-3
Timestamp: 2025-12-30T18:06:40.932Z
Learning: In the thechangelog/pipely repository, the go.mod file in the dagger/ directory (dagger/go.mod) is for Dagger's internal module. The Go version directive in this file is managed by Dagger itself, and compatibility/breaking change analysis for Go version updates in this file is not necessary since Dagger handles its own runtime compatibility.
Applied to files:
just/dagger.justdagger/go.moddagger.json.github/workflows/_namespace.yml
📚 Learning: 2025-07-03T08:51:11.320Z
Learnt from: gerhard
Repo: thechangelog/pipely PR: 18
File: dagger/main.go:292-304
Timestamp: 2025-07-03T08:51:11.320Z
Learning: When Go tools in dagger/main.go are pinned to specific commit hashes rather than release tags, this is intentional to access newer changes not yet included in releases. Avoid suggesting updates to release tags when commits are used, as the commits likely contain important unreleased features or fixes.
Applied to files:
just/dagger.justdagger/go.moddagger.json
📚 Learning: 2025-12-30T13:45:37.201Z
Learnt from: gerhard
Repo: thechangelog/pipely PR: 44
File: just/hurl.just:13-17
Timestamp: 2025-12-30T13:45:37.201Z
Learning: In Pipely's Justfiles, avoid defining color variables (GREEN, NORMAL, MAGENTA, BOLD, WHITE, CYAN, YELLOW, BLUE). Rely on Just's default color handling so output remains uncolored when colors aren’t defined. Do not hardcode empty strings or override defaults; let the tool manage color defaults for consistent behavior across Justfiles.
Applied to files:
just/dagger.just
📚 Learning: 2025-12-30T17:03:18.040Z
Learnt from: gerhard
Repo: thechangelog/pipely PR: 44
File: just/fly.just:94-98
Timestamp: 2025-12-30T17:03:18.040Z
Learning: In Fly.io deployments, create volumes only in the primary region and do not duplicate volume creation across multiple regions. Do not rely on regional replication for volumes. If you need global configuration, set environment variables (e.g., VARNISH_FILE_SIZE) once in a global scope so they apply to all machines, rather than per-region or per-instance.
Applied to files:
just/dagger.just
🪛 actionlint (1.7.9)
.github/workflows/_namespace.yml
17-17: label "namespace-experiments:dagger.integration=enabled;dagger.version=0.19.8" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🔇 Additional comments (9)
.github/workflows/_namespace.yml (2)
17-17: LGTM! Dagger version aligns with the broader upgrade.The dagger.version update to 0.19.8 is consistent with the changes in just/dagger.just and dagger.json.
22-24: LGTM! Just tooling updates match _github.yml.The setup-just@v3 and just-version 1.45.0 updates mirror the changes in _github.yml for consistency.
dagger/go.mod (3)
3-3: LGTM! Go version managed by Dagger.Based on learnings, the Go version in this file is managed by Dagger itself, and compatibility analysis is not necessary.
6-24: LGTM! Coordinated dependency updates.The updates to gqlgen (v0.17.81), gqlparser (v2.5.30), and OpenTelemetry components (v1.38.0 core, v0.14.0 log) are well-coordinated. The version alignment across OTLP exporters and SDK components is appropriate.
49-55: LGTM! Replace directives ensure version consistency.The replace directives pin the OTLP log-related packages to v0.14.0, ensuring consistent versions across the dependency tree.
dagger.json (2)
15-15: This is standard Dagger configuration for version upgrades.
disableDefaultFunctionCachingis automatically added during Dagger version upgrades to preserve backward-compatible "session" semantics. Keep it while updating function cache annotations, then remove it to opt into the new default 7-day TTL caching. No action needed now.
10-10: The flyio dependency configuration is correct. The@mainreference with an explicit commit pin is a standard pattern to access unreleased features while ensuring reproducible builds. No changes required..github/workflows/_github.yml (1)
16-20: Clarify checkout action difference between workflows.The
extractions/setup-just@v3andjust-version: 1.45.0are aligned across both _github.yml and _namespace.yml. However, the checkout actions differ: _github.yml usesactions/checkout@v5(GitHub's official action) while _namespace.yml usesnamespacelabs/nscloud-checkout-action@v5(Namespace Labs' action). Verify this intentional difference is correct for your workflow requirements. Note thatactions/checkout@v5requires GitHub Actions Runner v2.327.1 or later and uses Node.js 24.Likely an incorrect or invalid review comment.
just/dagger.just (1)
4-4: LGTM! Dagger v0.19.8 is confirmed and stable.The version is available on GitHub releases (released December 4, 2025) and contains only minor improvements and optimizations with no breaking changes or critical issues.
Hold Varnish at v7 until v8 becomes more mature. By the way things are going, we are most likely going to wait until the Vynil rename completes, and then we roll out that new major version in parallel.
Summary by CodeRabbit
Chores
Documentation
✏️ Tip: You can customize this high-level summary in your review settings.