build(deps): Bump gocloud.dev/pubsub/kafkapubsub from 0.40.0 to 0.46.0#3080
Conversation
dependabot
Bot
added
dependencies
![kodiakhq[bot]](https://avatars.githubusercontent.com/in/29196?s=60&v=4){kind=small}
8976436 to
04a6114
Compare
Kusari Analysis Results:Caution Flagged Issues Detected The code security analysis is clean with zero issues, secrets, or workflow concerns. However, the dependency analysis raises a license compliance concern that we strongly recommend addressing before merging. The PR introduces github.com/rcrowley/go-metrics (v0.0.0-20250401214520-65e299d6c5c9) as a transitive dependency via gocloud.dev/pubsub/kafkapubsub@v0.46.0. This package carries a BSD-2-Clause-Views license, classified as 'non oss' due to an advertising-clause-like restriction that may conflict with your project's open-source license policy. Additionally, this package has a 0/10 maintenance score, indicating it is effectively unmaintained, which introduces long-term supply chain risk. Recommended actions: (1) Have your legal or open-source compliance team review the BSD-2-Clause-Views license terms to confirm compatibility with your project's license policy. (2) If incompatible, evaluate pinning gocloud.dev/pubsub/kafkapubsub to a prior version that does not pull in this dependency, or consider an alternative Kafka pub/sub integration. (3) If your project already has an approved exception for this license type, document and attach that exception before merging. All other new dependencies (IBM/sarama, pierrec/lz4/v4) carry permissive licenses with no advisories and are safe. Note View full detailed analysis result for more information on the output and the checks that were run. Required Dependency Mitigations
Found this helpful? Give it a 👍 or 👎 reaction! |
|
Kusari PR Analysis rerun based on - 04a6114 performed at: 2026-06-23T14:33:10Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - 04a6114 performed at: 2026-06-23T17:25:08Z - link to updated analysis |
04a6114 to
8cc65f8
Compare
|
Kusari PR Analysis rerun based on - 8cc65f8 performed at: 2026-07-07T13:14:46Z - link to updated analysis |
|
This upgrade needs some minor code changes. Raised PR #3108 for this upgrade. |
Bumps [gocloud.dev/pubsub/kafkapubsub](https://github.com/google/go-cloud) from 0.40.0 to 0.46.0. - [Release notes](https://github.com/google/go-cloud/releases) - [Commits](google/go-cloud@v0.40.0...v0.46.0) --- updated-dependencies: - dependency-name: gocloud.dev/pubsub/kafkapubsub dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
8cc65f8 to
80fe68b
Compare
|
Kusari PR Analysis rerun based on - 80fe68b performed at: 2026-07-17T13:40:55Z - link to updated analysis |
2 participants
Bumps gocloud.dev/pubsub/kafkapubsub from 0.40.0 to 0.46.0.
Release notes
Sourced from gocloud.dev/pubsub/kafkapubsub's releases.
... (truncated)
Commits
60f0d74all: prereleasea1725f0blob/s3blob: migrate from deprecated s3/manager to s3/transfermanager (#3717)7eadd65aws: add AWS IAM Role assumption support (#3716)054c82epostgres/awspostgres: add IAM authentication support (#3713)2b85c85docs: fix Pub/Sub subscribe wording (#3714)b9dee8dbuild: add top-level permissions restriction to tests workflow (#3711)45a8cfcdocstore: support unwrapping ActionListError for use with errors.Is (#3705)78b5976all: support typed errors and errors.Is for error codes (#3708)595f8b6all: update another otel dep (#3701)c903aefall: update otel deps (#3699)