villebro opened a new pull request, #291: URL: https://github.com/apache/superset-kubernetes-operator/pull/291
## Summary Renovate disables indirect (transitive) `gomod` dependencies by default, and `config:best-practices` doesn't change that. As a result Go's minimal-version-selection only floats an indirect module up when a *direct* parent requires a newer version, leaving transitive deps pinned below their latest supported SemVer. That is the root cause of the four OpenSSF Scorecard **Vulnerabilities** advisories addressed by the manual bump in #290 (cel-go, otel, x/mod): the versions were flagged by Scorecard's version-based OSV scan even though our reachability-based `govulncheck` gate stayed green. This enables indirect deps so they track latest going forward, closing the loop so we don't rely on manual bumps or the weekly Scorecard run to notice transitive drift. ## Details Adds a single `packageRule` (`matchManagers: ["gomod"]`, `matchDepTypes: ["indirect"]`, `enabled: true`). Indirect updates fold into the existing "Go dependencies" group and keep the 7-day `minimumReleaseAge` soak, so this doesn't create a flood of separate PRs. Every bump is still gated by the existing CI suite — build, unit/integration/e2e, `govulncheck`, and Trivy — so a breaking transitive update fails its PR rather than merging. This matches the desired policy: **be on the latest supported indirect SemVer at all times, unless something actually breaks.** If a module genuinely breaks at latest, hold it lower with a per-package rule (`allowedVersions` or `enabled: false`), as documented in the rule's `description`. Validated with `renovate-config-validator` (config validated successfully). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
