From dfa67c7e957dc574b16f19cbde64bd870291c418 Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Tue, 1 Sep 2026 08:58:36 -0400 Subject: [PATCH] chore: ignore gobwas/glob major bumps until OPA migrates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit glob v1 is a breaking API change, not just the engine rewrite its release notes describe: Compile went from returning the Glob interface to a concrete *Pattern, and the Glob interface was removed. authlib declares glob.Glob in three packages (listener/skiphost, routing, plugins/tokenbroker), and OPA declares it as well — v1/topdown/glob.go and v1/bundle/bundle.go, still true at 1.20.1 — so glob v1 cannot be adopted here until OPA migrates. That is outside this repo, so #829 would be reopened on every glob release with no action available. Applied to the four gomod directories that require glob and have a Dependabot entry. storage/redis does not require it; cmd/authbridge-cpex and cmd/authbridge-praxis require it but have no Dependabot entry. Matching semantics are deliberately not cited as a reason: a v0.2.3-vs-v1.0.0 differential over the repo's real pattern corpus (36 patterns x 29 hosts) differed on two cells only, both on the empty host, which skiphost never passes to glob. The contract is pinned separately in #837. Drop this ignore once OPA is on the glob v1 API. Assisted-By: Claude (Anthropic AI) Signed-off-by: Hai Huang --- .github/dependabot.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 29f0af9a..0612cdec 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,21 +16,48 @@ updates: directory: /authbridge/authlib schedule: interval: weekly + ignore: + # gobwas/glob v1 is a breaking API change, not just the engine rewrite + # its release notes describe: Compile went from returning the Glob + # interface to a concrete *Pattern, and Glob was removed. authlib + # declares glob.Glob in listener/skiphost, routing and + # plugins/tokenbroker — and OPA declares it too (v1/topdown/glob.go, + # v1/bundle/bundle.go, still true at 1.20.1), so v1 cannot be adopted + # here until OPA migrates. Blocked outside this repo; see #829. + # + # Matching semantics are NOT the blocker: a v0.2.3-vs-v1.0.0 diff over + # the repo's real pattern corpus (36 patterns x 29 hosts) differed only + # on the empty host, which skiphost never passes to glob. Drop this + # ignore once OPA is on the glob v1 API. + - dependency-name: "github.com/gobwas/glob" + update-types: ["version-update:semver-major"] # Go - mode-specific binaries - package-ecosystem: gomod directory: /authbridge/cmd/authbridge-proxy schedule: interval: weekly + ignore: + # See the authlib entry above for why glob v1 is blocked. + - dependency-name: "github.com/gobwas/glob" + update-types: ["version-update:semver-major"] - package-ecosystem: gomod directory: /authbridge/cmd/authbridge-envoy schedule: interval: weekly + ignore: + # See the authlib entry above for why glob v1 is blocked. + - dependency-name: "github.com/gobwas/glob" + update-types: ["version-update:semver-major"] # Go - abctl TUI - package-ecosystem: gomod directory: /authbridge/cmd/abctl schedule: interval: weekly + ignore: + # See the authlib entry above for why glob v1 is blocked. + - dependency-name: "github.com/gobwas/glob" + update-types: ["version-update:semver-major"] # Go - storage backends (direct deps: go-redis, miniredis) - package-ecosystem: gomod