* test: reduce oversized expectation literals to representative examples
* test: shrink oversized fixtures instead of trimming assertions
Cut the real-world fixtures down to a representative set of entries that still covers every parser shape, and assert the complete output again with a single toEqual.
* test(manager): replace file snapshots with explicit assertions
* test(manager): replace inline snapshots with explicit assertions
* test(manager): assert on relevant sections instead of full bodies
* test(manager): drop assertions implied by full equality
* test(manager): address review feedback
* test(manager): assert depType and versioning in the regex matcher
* fix(gomod): pseudo-version digest updates produce no change when module
is absent from go proxy
* Update lib/modules/manager/gomod/update.spec.ts
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
---------
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
When a Go dependency uses a pseudo-version (v0.0.0-timestamp-hash) and
Renovate detects a newer pseudo-version, updateType is set to 'digest'
via the gomod special-case in lookup/index.ts. The digest update code
path was then writing only the 12-character bare commit hash, producing
invalid go.mod syntax:
- knative.dev/pkg v0.0.0-20250312035536-b7bbf4be5dbd
+ knative.dev/pkg 4a022ed9999a
Historical cause:
In 2018, the Go module proxy did not yet exist. Renovate queried the
GitHub API for the latest commit SHA and had no way to obtain the correct
commit timestamp, so it fabricated a pseudo-version using the wall-clock
time when Renovate ran. The result was syntactically valid but semantically
wrong. Go 1.11 and 1.12 did not validate pseudo-version timestamps, and
`go get` would normalise the fabricated version to the correct one anyway,
so this worked in practice.
Go 1.13 (2019) introduced strict pseudo-version timestamp validation,
rejecting any pseudo-version whose timestamp does not match the actual
commit time. Renovate's fix (31ce47297) was to drop the fabricated
timestamp entirely and write just the bare commit hash, then rely on
`go get` to expand it into a canonical pseudo-version. However, when
the `go get` command or other subsequent operations fail, Renovate may
leave the go.mod file containing dependencies pinned to bare commit hashes.
Why the fix is now safe:
Since the 2024 goproxy datasource changes, both newValue and newDigest are
extracted from the same proxy version string via pseudoVersionToRelease().
They always reference the same commit, so writing newValue directly produces
correct, syntactically valid go.mod output without depending on `go get` to
clean it up afterward.
Signed-off-by: Qixiang Wan <qwan@outlook.com>
As noted in #41260, if a Go module is using a `replace` with both
modules with the same name, the major upgrade fails to produce a valid
`go.mod`, as the `replace` will still partially reference the old
package.
Moves datasource, manager, platform and versioning code from lib/ into new lib/modules/
BREAKING CHANGE: External tools must update paths to datasource, manager, platform and versioning
Sebastian Poxhofer