build(deps): bump github.com/mikefarah/yq/v4 from 4.49.2 to 4.50.1#4460
build(deps): bump github.com/mikefarah/yq/v4 from 4.49.2 to 4.50.1#4460dependabot[bot] wants to merge 1 commit intomasterfrom
Conversation
dependabot
bot
added
dependencies
| github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect | ||
| github.com/go-ini/ini v1.67.0 // indirect | ||
| github.com/google/jsonschema-go v0.3.0 // indirect | ||
| github.com/hashicorp/hcl/v2 v2.24.0 // indirect |
There was a problem hiding this comment.
https://github.com/lima-vm/lima/actions/runs/20217415615/job/58032762244?pr=4460
Not allowed license MPL-2.0 found for library github.com/hashicorp/hcl/v2
There was a problem hiding this comment.
|
|
||
| require ( | ||
| github.com/agext/levenshtein v1.2.1 // indirect | ||
| github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect |
There was a problem hiding this comment.
Seems complicated https://github.com/apparentlymart/go-textseg/blob/master/LICENSE
There was a problem hiding this comment.
Yeah, that dependency seems to have been added after the license exception had been granted, so I think hashicorp/hcl is no longer permitted.
I've filed mikefarah/yq#2563 to see if Mike is open to put HCL support behind Go build tags.
There was a problem hiding this comment.
dependabot
bot
force-pushed
the
dependabot/go_modules/github.com/mikefarah/yq/v4-4.50.1
branch
from
a654813 to
0ab0904
Compare
Bumps [github.com/mikefarah/yq/v4](https://github.com/mikefarah/yq) from 4.49.2 to 4.50.1. - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@v4.49.2...v4.50.1) --- updated-dependencies: - dependency-name: github.com/mikefarah/yq/v4 dependency-version: 4.50.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/go_modules/github.com/mikefarah/yq/v4-4.50.1
branch
from
0ab0904 to
d210dc1
Compare
|
Turning this into a draft. It is already superseded by #4522, but that is also a draft because we need to wait for the regressions to be fixed, and then figure out how to deal with the licensing issue. |
|
Superseded by #4555. |
dependabot
bot
deleted the
dependabot/go_modules/github.com/mikefarah/yq/v4-4.50.1
branch
2 participants
Bumps github.com/mikefarah/yq/v4 from 4.49.2 to 4.50.1.
Release notes
Sourced from github.com/mikefarah/yq/v4's releases.
Changelog
Sourced from github.com/mikefarah/yq/v4's changelog.
Commits
065b200Bumping version745a7ffPreparing releasea305d70Bump golang.org/x/net from 0.47.0 to 0.48.00671ccdBump github.com/zclconf/go-cty from 1.16.3 to 1.17.04d8cd45Bump golang.org/x/text from 0.31.0 to 0.32.0d2d657eHCL improvementsf4fd8c5Better roundtriping of HCLe4bf8a1Simplifying HCL decoderfd40574Add build tag to hcl_test.go to skip tests when HCL is disabled51ddf8dUpdate pkg/yqlib/format.goYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)