chore(deps): bump go.uber.org/mock from 0.5.2 to 0.6.0 by dependabot[bot] · Pull Request #621 · launchdarkly/ldcli

dependabot · 2025-09-22T04:10:03Z

Bumps go.uber.org/mock from 0.5.2 to 0.6.0.

Release notes

Sourced from go.uber.org/mock's releases.

v0.6.0

0.6.0 (18 Aug 2025)

Added

#258[]: Archive mode: a new mockgen mode that generates mocks out of archive files.

Fixed

#276[]: Fixed mockgen errors with go1.25 due to outdated golang.org/x/tools dependency.

#258: uber-go/mock#258 #276: uber-go/mock#276

Changelog

Sourced from go.uber.org/mock's changelog.

0.6.0 (18 Aug 2025)

Added

#258[]: Archive mode: a new mockgen mode that generates mocks out of archive files.

#262[]: Support for specifying mock names when using the _gomock_archive bazel rule.

Fixed

#276[]: Fixed mockgen errors with go1.25 due to outdated golang.org/x/tools dependency.

#258: uber-go/mock#258 #262: uber-go/mock#262 #276: uber-go/mock#276

Commits

2d1c581 Prepare release v0.6.0 (#278)
c654195 Update CI to run 1.24/1.25 (#277)
5900c74 update golang.org/x/tools to v0.36.0 (#276)
6a0445c feat(bazel): mock_names flag support in archive mode (#262)
aa11bfc feat(bazel): support archive mode (#259)
359202c Support for archive mode (#258)
871d86b Back to development (#251)
See full diff in compare view

Note

Overview
Dependency-only update: bumps go.uber.org/mock from 0.5.2 to 0.6.0 in go.mod and go.sum. No application or test source changes in this PR.

The newer release mainly affects mockgen (archive mode, Bazel archive options) and fixes mockgen failures on Go 1.25 via an updated golang.org/x/tools dependency—relevant because this module targets Go 1.25.0.

^{Reviewed by Cursor Bugbot for commit aa6e3df. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor · 2026-09-18T23:50:56Z

Resolved the go.mod / go.sum conflicts against current main as #805.

That replacement keeps only the intended bump (go.uber.org/mock v0.5.2 → v0.6.0) and drops the stale transitive pins from this branch (x/term, x/mod, x/net, x/sys, x/tools), which would now be downgrades.

…ced updates - pr-disclosure strips bot blocks ( … , such as the Cursor Bugbot summary) and the <details> sections that quote upstream notes. On #737, golang.org/x/term was named only in the Bugbot summary, and the check passed. - A direct Go update that a named update requires at the new version or higher is forced (deps.py forced walks go mod graph). It is a note, not a decision. On #621, mock 0.6.0 needs x/term 0.34.0 through x/tools and x/net. - The check calls an update grouped only if the title says so. - deps.py licenses also reports the package name, version, and dev flag. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

…old image tags - actions_analysis: evaluate defaults as github.com does. A GHES fallback (github.server_url == 'https://github.com' && X || Y) is X, so the setup-python token default is not a change (#721). The question names the workflows that use the action. - license-changes: one item per package family, which says dev-only build tools: "Accept MPL-2.0 for lightningcss 1.33.0 and 11 lightningcss-* package(s) (dev-only build tools)?" (#779). - verdict.jq: a guard regression or a failing gate already shows that a change reaches ldcli, so the missing discriminating proof is not an incomplete item (#723, #729, #779). - release-snapshot: accept a tagged release image. A conflicting PR is tested at its old head, and trees from before #629 use goreleaser-cross:v1.24.2 instead of a digest (#621). Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

New fixtures: #621 (forced x/term update, not grouped, release snapshot on the old tree) and #737 (x/term named only in the Bugbot summary). The #723 fixture expects no audit question and full note coverage. The #779 fixture expects full note coverage, GHSA IDs, and the short license question. The #721 fixture expects no token default in the question. run.sh adds 12 unit tests with stub tools: bot text and <details> in pr-disclosure, forced Go updates, npm audit advisory IDs, note coverage (partial CHANGELOG, missing tag, release scan past 3 pages), the license family question, impact proof with a guard regression, and the govulncheck levels. Each one fails on the code before this change. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

nieblara · 2026-10-19T20:00:10Z

@dependabot rebase

Bumps [go.uber.org/mock](https://github.com/uber/mock) from 0.5.2 to 0.6.0. - [Release notes](https://github.com/uber/mock/releases) - [Changelog](https://github.com/uber-go/mock/blob/main/CHANGELOG.md) - [Commits](uber-go/mock@v0.5.2...v0.6.0) --- updated-dependencies: - dependency-name: go.uber.org/mock dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

cursor · 2026-10-19T21:06:11Z

Dependency verification: SAFE TO MERGE

Risk tier high (codegen, mocks) · ecosystems: gomod · head aa6e3df tested as merged into main @ a9fce2d

Every required check ran and passed. No decision is necessary.

The September head da09a15 conflicted with main in go.mod and go.sum. After a @dependabot rebase comment on 2026-10-19, Dependabot pushed aa6e3df on top of main @ a9fce2d, so the conflict is gone. This head is byte-identical to go get go.uber.org/mock@v0.6.0 && go mod tidy on that commit, and it changes only the go.uber.org/mock lines. On that simulated rebase, build, vet, tests, mockgen regeneration for all 6 directives, and golangci-lint pass. govulncheck reports the same 12 reachable advisories as main. Draft #805 makes the same change on an older main and is a duplicate of this PR.

Updates

Package	From	To	Change	Ecosystem	Tier
`go.uber.org/mock`	v0.5.2	v0.6.0	minor (0.x: breaking allowed)	gomod	high

What the verifier checked

Check	Result	Summary
PR merges cleanly and changes only dependency files	pass	Merges cleanly into main; only dependency manifests changed
CI results on the PR head	pass	All 4 expected workflow run(s) and 3 other check(s) green on PR head `aa6e3df`
No dependency goes to a lower version than base	pass	No downgrades
Upstream release notes and diff of each direct update	pass (note)	Upstream notes cover the full range for 1 of 1 direct update(s). The impact review must cover them
Transitive dependency changes (new, removed, major, install scripts)	pass (note)	gomod: 1 changed (a 0.x minor update), 0 added, 0 removed
Licenses of new and changed dependencies	pass	All 1 added or changed dependencies use a license in the policy, with no license change
go mod tidy makes no change to go.mod or go.sum	pass	go.mod/go.sum are tidy
go and toolchain directives (unchanged, or the new version is supported)	pass	go 1.25.0 (unchanged)
go build and go vet	pass	go build ./... and go vet ./... succeed
go test ./... (isolated environment)	pass	55 packages pass
go generate makes no change, and the generated code builds	fails on base too	go generate rewrites 1 file(s) and the regenerated code does not compile
govulncheck: no new reachable vulnerabilities	pass	No new reachable vulnerabilities; still reachable: GO-2026-5320, GO-2026-5970, GO-2026-6603, GO-2026-6605, GO-2026-6607, GO-2026-6608, GO-2026-6609, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6613, GO-2026-6617
All release targets cross-compile in goreleaser-cross (CGO)	pass	All 8 release targets build in goreleaser-cross (the public image with musl.cc toolchains, not the release image)
golangci-lint (pre-commit configuration)	pass	golangci-lint clean (v1.63.4)
Binary smoke test: --version, help for all commands, dev-server serves the UI and API	pass	--version, --help for 419 commands, dev-server UI and API all OK
CLI help output is the same as on base	pass	Help output identical for 419 commands

Already failing on `main` (not caused by this PR)

go generate makes no change, and the generated code builds: go generate rewrites 1 file(s) and the regenerated code does not compile

Generated checks

A generated check counts only when it fails on the old version and passes on the new one. 0 of 1 proven.

Check	Kind	Base	PR	Outcome
mockgen regenerates every committed mock without change, and the dev-server tests pass with them	guard	pass	pass	holds on both

Impact review

go.uber.org/mock v0.5.2 to v0.6.0 adds a mockgen archive mode, refactors the mockgen mode switch, and raises the golang.org/x/tools floor to v0.36.0 so that mockgen works with Go 1.25. The gomock runtime package has no change in this range. ldcli runs mockgen in package mode through 6 go:generate directives in internal/dev_server and pins it in tools.go. The dev-server tests use the mocks, and adapters/internal/mocks.go compiles gomock into the binary. main already requires x/tools v0.42.0, so no other module moves. The regenerated mocks are identical. The rebased head aa6e3df is byte-identical to go get go.uber.org/mock@v0.6.0 && go mod tidy on main a9fce2d.

go.uber.org/mock v0.5.2..v0.6.0: Added archive mode (Support for archive mode uber-go/mock#258) and a new -archive flag. Fixed mockgen errors with go1.25 by raising golang.org/x/tools to v0.36.0 (update golang.org/x/tools to v0.36.0 uber-go/mock#276). mockgen.go now uses a switch for gob, source, archive, and package mode, and -exclude_interfaces is no longer described as source-mode only. No file under gomock/ changed, so the runtime API and behavior are unchanged. (source)
Used in: tools.go, internal/dev_server/adapters/api.go, internal/dev_server/adapters/sdk.go, internal/dev_server/adapters/internal/api_util.go, internal/dev_server/adapters/internal/mocks.go, internal/dev_server/model/store.go, internal/dev_server/model/observer.go, internal/dev_server/model/event_store.go, internal/dev_server/adapters/mocks/, internal/dev_server/model/mocks/
Upstream behavior changes that reach ldcli: no
Note: mockgen 0.6.0 regenerates all 6 committed mocks without change, one for each committed MockGen file, and the dev-server tests pass with them (guard, holds on both sides). All 6 directives use package mode (mockgen . Iface). The package-mode code path in mockgen.go is unchanged apart from moving the argument check into checkArgs(). ldcli does not use archive mode. (generated/mocks-regenerate-identically.sh, Support for archive mode uber-go/mock#258)
Note: gomock is compiled into the ldcli binary through internal/dev_server/adapters/internal/mocks.go, which is not a test file. The compare range changes no file under gomock/, so the shipped code is the same. (uber-go/mock@v0.5.2...v0.6.0, internal/dev_server/adapters/internal/mocks.go)
Note: The Go 1.25 fix (update golang.org/x/tools to v0.36.0 uber-go/mock#276) raises the x/tools floor to v0.36.0. main already requires golang.org/x/tools v0.42.0 and golang.org/x/term v0.40.0, so go mod tidy moves no other module. The x/term v0.34.0 update in the September head of this PR is gone. (go.mod: golang.org/x/tools v0.42.0 // indirect, update golang.org/x/tools to v0.36.0 uber-go/mock#276)
Note: Dependabot rebased the PR on 2026-10-19 to aa6e3df on top of main a9fce2d. Its go.mod and go.sum are byte-identical to go get go.uber.org/mock@v0.6.0 && go mod tidy on that commit. Draft chore(deps): bump go.uber.org/mock from 0.5.2 to 0.6.0 #805 changes the same lines with the same go.sum hashes on an older main, so it is a duplicate of this PR. (chore(deps): bump go.uber.org/mock from 0.5.2 to 0.6.0 #805)

Check details

ci-status

Workflows that PR CI must run on aa6e3df, and their runs on that commit:

Workflow	Event	Run	Result
`.github/workflows/dependency-scan.yml`	pull_request	39315803543 2026-10-19	pass: success
`.github/workflows/dev-server-ui.yml`	pull_request	39315804231 2026-10-19	pass: success
`.github/workflows/go.yml`	pull_request	39315803650 2026-10-19	pass: success
`.github/workflows/lint-pr-title.yml`	pull_request_target	39315844040 2026-10-19	pass: success

Check Cursor Bugbot: success
Check Require additional human oversight on bot PRs: success
Check semgrep-cloud-platform/scan: success

upstream-changes

go.uber.org/mock v0.5.2 → v0.6.0: uber/mock, 7 commits, 19 files, notes: release notes, full range

transitive-changes

gomod (modules compiled into ldcli): 1 changed, 0 added, 0 removed
- go.uber.org/mock v0.5.2 → v0.6.0 (minor, 0.x)

license-changes

go.uber.org/mock@v0.6.0: Apache-2.0

go-generate-drift

Files rewritten by go generate ./... (patch saved as drift.patch next to this check's status):

 internal/dev_server/api/server.gen.go | 430 +++++++++++++++-----
 1 file changed, 323 insertions(+), 107 deletions(-)

The regenerated code does not compile:

# github.com/launchdarkly/ldcli/internal/dev_server/api
internal/dev_server/api/data_mapping.go:11:5: unknown field Id in struct literal of type Variation
internal/dev_server/api/get_project.go:20:3: unknown field LastSyncedFromSource in struct literal of type ProjectJSONResponse
internal/dev_server/api/patch_project.go:24:3: unknown field LastSyncedFromSource in struct literal of type ProjectJSONResponse
internal/dev_server/api/post_add_project.go:38:3: unknown field LastSyncedFromSource in struct literal of type ProjectJSONResponse
internal/dev_server/api/post_import_project.go:45:21: v.Id undefined (type Variation has no field or method Id)
internal/dev_server/api/post_import_project.go:75:3: unknown field LastSyncedFromSource in struct literal of type ProjectJSONResponse
internal/dev_server/api/server.gen.go:382:16: undefined: runtime.BindQueryParameterWithOptions
internal/dev_server/api/server.gen.go:382:114: undefined: runtime.BindQueryParameterOptions
internal/dev_server/api/server.gen.go:384:30: undefined: runtime.RequiredParameterError
internal/dev_server/api/server.gen.go:395:16: undefined: runtime.BindQueryParameterWithOptions
internal/dev_server/api/server.gen.go:395:16: too many errors

govulncheck

Still reachable on the PR: GO-2026-5320 (github.com/yuin/goldmark, fixed in v1.7.17), GO-2026-5970 (golang.org/x/text, fixed in v0.39.0), GO-2026-6603 (stdlib, fixed in v1.26.9), GO-2026-6605 (stdlib, fixed in v1.26.9), GO-2026-6607 (stdlib, fixed in v1.26.9), GO-2026-6608 (stdlib, fixed in v1.26.9), GO-2026-6609 (stdlib, fixed in v1.26.9), GO-2026-6610 (stdlib, fixed in v1.26.9), GO-2026-6611 (stdlib, fixed in v1.26.9), GO-2026-6612 (stdlib, fixed in v1.26.9), GO-2026-6613 (stdlib, fixed in v1.26.9), GO-2026-6617 (stdlib, fixed in v1.26.9)

release-snapshot

Release image not pullable (unauthorized). Fallback: public goreleaser/goreleaser-cross:v1.24.2 (goreleaser/goreleaser-cross@sha256:c4bfde12925cd9e23faae3e35…) with sha256-pinned musl.cc toolchains at /musl.
dist/ldcli_darwin_amd64_v1/ldcli: Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE>
dist/ldcli_darwin_arm64_v8.0/ldcli: Mach-O 64-bit arm64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE>
dist/ldcli_linux_386_sse2/ldcli: ELF 32-bit LSB executable, Intel 80386
dist/ldcli_linux_amd64_v1/ldcli: ELF 64-bit LSB executable, x86-64
dist/ldcli_linux_arm64_v8.0/ldcli: ELF 64-bit LSB executable, ARM aarch64
dist/ldcli_windows_386_sse2/ldcli.exe: PE32 executable (console) Intel 80386, for MS Windows
dist/ldcli_windows_amd64_v1/ldcli.exe: PE32+ executable (console) x86-64, for MS Windows
dist/ldcli_windows_arm64_v8.0/ldcli.exe: PE32+ executable (console) Aarch64, for MS Windows
Fidelity gap: the public image plus musl.cc replace the LaunchDarkly image, which can have extras that this build does not have.
Fidelity gap: the binaries are built, but not executed.
Fidelity gap: goreleaser build does not run the dockers, docker_manifests, or brews steps.

binary-smoke

ldcli --version: ldcli version dev
dev-server served /ui/ (1160 KB) and /dev/projects ([])

generated: mocks-regenerate-identically

mockgen from go.mod: v0.6.0
Regenerated 6 mocks (one for each committed MockGen file). No file changed, and go test ./internal/dev_server/... passes.

_{Generated by scripts/dependency-pr/verify.sh (profile full) at 2026-10-19T21:04:21Z. The verifier does not approve or merge.}

The #621 run used a generated guard for this. go-generate-drift already fails on main because of the stale server.gen.go (#720), so it cannot show whether the mocks drift. The new check runs only for go.uber.org/mock updates. It runs each mockgen directive, requires no diff, and requires one directive for each committed MockGen file. Co-authored-by: rniebla <rniebla@launchdarkly.com>

transitive-changes called golang.org/x/sys v0.41.0 → v0.45.0 major, and the comment called it minor (#873, #621). deps.py, the transitive list in the comment, and the nested-action diff now all say 0.x minor. Co-authored-by: rniebla <rniebla@launchdarkly.com>

The details printed the output of file -b as it was, so text such as flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> was outside code, and each post of #725, #828, #871, #874, and #621 needed a hand edit. Co-authored-by: rniebla <rniebla@launchdarkly.com>

… ldcli PRs Bare npm scopes such as @launchpad-ui/core and @types/react-window became GitHub mentions (#723), and an upstream #258 linked to ldcli PR #258 (#621). render-comment.sh now sends its Markdown through comment_safe.py, which puts bare @-tokens and raw <...> text in backticks outside code. A bare #N in an impact review changelog entry becomes owner/repo#N, with the repository from the entry URL or the upstream-changes report. The upstream commit subjects get the same prefix. Co-authored-by: rniebla <rniebla@launchdarkly.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 22, 2025

dependabot Bot force-pushed the dependabot/go_modules/go.uber.org/mock-0.6.0 branch from 630954b to da09a15 Compare September 26, 2025 14:46

This was referenced Sep 18, 2026

chore: add a maintainer skill for verifying Dependabot upgrades #804

Draft

chore(deps): bump go.uber.org/mock from 0.5.2 to 0.6.0 #805

Closed

cursor Bot mentioned this pull request Oct 6, 2026

feat(deps): agent-driven Dependabot PR verifier (phase 1) #849

Draft

2 of 3 tasks

dependabot Bot force-pushed the dependabot/go_modules/go.uber.org/mock-0.6.0 branch from da09a15 to aa6e3df Compare October 19, 2026 20:01

dependabot Bot requested a review from a team as a code owner October 19, 2026 20:01

nieblara approved these changes Oct 19, 2026

View reviewed changes

nieblara merged commit c9592f2 into main Oct 20, 2026
11 checks passed

nieblara deleted the dependabot/go_modules/go.uber.org/mock-0.6.0 branch October 20, 2026 02:55

Navigation Menu

Repository navigation

chore(deps): bump go.uber.org/mock from 0.5.2 to 0.6.0 - #621

chore(deps): bump go.uber.org/mock from 0.5.2 to 0.6.0#621
nieblara merged 1 commit into
mainfrom
dependabot/go_modules/go.uber.org/mock-0.6.0

dependabot Bot commented on behalf of github Sep 22, 2025 •

edited by cursor Bot

Loading

Uh oh!

cursor Bot commented Sep 18, 2026

Uh oh!

nieblara commented Oct 19, 2026

Uh oh!

cursor Bot commented Oct 19, 2026

ci-status

upstream-changes

transitive-changes

license-changes

go-generate-drift

govulncheck

release-snapshot

binary-smoke

generated: mocks-regenerate-identically

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 22, 2025 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.6.0

0.6.0 (18 Aug 2025)

Added

Fixed

0.6.0 (18 Aug 2025)

Added

Fixed

Uh oh!

cursor Bot commented Sep 18, 2026

Uh oh!

nieblara commented Oct 19, 2026

Uh oh!

cursor Bot commented Oct 19, 2026

Dependency verification: SAFE TO MERGE

Updates

What the verifier checked

Already failing on main (not caused by this PR)

Generated checks

Impact review

ci-status

upstream-changes

transitive-changes

license-changes

go-generate-drift

govulncheck

release-snapshot

binary-smoke

generated: mocks-regenerate-identically

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 22, 2025 •

edited by cursor Bot

Loading

Already failing on `main` (not caused by this PR)