You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Replace problematic release of github.com/jandelgado/gcov2lcov dependency
This is a transitive dependency of `github.com/ory/jsonschema/v3`.
`go mod tidy` fails after Dependabot bumps to `github.com/ory/jsonschema/v3@v3.0.4`:
```
go: downloading github.com/jandelgado/gcov2lcov v1.0.4
verifying github.com/jandelgado/gcov2lcov@v1.0.4: checksum mismatch
downloaded: h1:ADwQPyNsxguqzznIbfQTENwY9FU88JdXEvpdHR9c48A=
go.sum: h1:54+QJDjOQcRMLsC6aFXeYKQ+GEhN2DaYfKEtjDWnOrM=
SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
For more information, see 'go help module-auth'.
```
I suspect that it was caused by the `github.com/jandelgado/gcov2lcov@v1.0.4` tag having been moved (similar to what
happened with `github.com/oleiade/reflections@v1.0.0`).
Since `github.com/jandelgado/gcov2lcov` is only a testing tool used by `github.com/ory/jsonschema/v3`, which imports it
as blank identifier as a hacky technique to use the Go module system for tool dependency management:
https://marcofranssen.nl/manage-go-tools-via-go-modules
For this reason, `github.com/jandelgado/gcov2lcov` is not actually a dependency of Arduino Lint and the version specified
here is irrelevant other than that v1.0.4 breaks Dependabot. So there is no possible impact from using v1.0.5 in its
place.
In the interest of keeping the `go.mod` file clean, this line should be removed once `github.com/ory/jsonschema/v3`
updates to a non-problematic version of its tool dependency.
Copy file name to clipboardExpand all lines: docsgen/go.mod
+2Lines changed: 2 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -5,6 +5,8 @@ go 1.16
5
5
6
6
replacegithub.com/arduino/arduino-lint => ../
7
7
8
+
replacegithub.com/jandelgado/gcov2lcov => github.com/jandelgado/gcov2lcovv1.0.5// v1.0.4 causes Dependabot updates to fail due to checksum mismatch (likely a moved tag). This is an unused transitive dependency, so version is irrelevant.
replacegithub.com/jandelgado/gcov2lcov => github.com/jandelgado/gcov2lcovv1.0.5// v1.0.4 causes Dependabot updates to fail due to checksum mismatch (likely a moved tag). This is an unused transitive dependency, so version is irrelevant.
Copy file name to clipboardExpand all lines: ruledocsgen/go.mod
+2Lines changed: 2 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -4,6 +4,8 @@ go 1.16
4
4
5
5
replacegithub.com/arduino/arduino-lint => ../
6
6
7
+
replacegithub.com/jandelgado/gcov2lcov => github.com/jandelgado/gcov2lcovv1.0.5// v1.0.4 causes Dependabot updates to fail due to checksum mismatch (likely a moved tag). This is an unused transitive dependency, so version is irrelevant.
0 commit comments