build(deps): Bump gocloud.dev/pubsub/kafkapubsub from 0.40.0 to 0.46.0#3080
build(deps): Bump gocloud.dev/pubsub/kafkapubsub from 0.40.0 to 0.46.0#3080dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![kodiakhq[bot]](https://avatars.githubusercontent.com/in/29196?s=60&v=4){kind=small}
Bumps [gocloud.dev/pubsub/kafkapubsub](https://github.com/google/go-cloud) from 0.40.0 to 0.46.0. - [Release notes](https://github.com/google/go-cloud/releases) - [Commits](google/go-cloud@v0.40.0...v0.46.0) --- updated-dependencies: - dependency-name: gocloud.dev/pubsub/kafkapubsub dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/go_modules/gocloud.dev/pubsub/kafkapubsub-0.46.0
branch
from
8976436 to
04a6114
Compare
Kusari Analysis Results:Caution Flagged Issues Detected The code security analysis returned zero findings — no code issues, exposed secrets, or workflow concerns were detected in the scanned files (go.mod, go.sum). However, the dependency analysis identified a license compliance concern that warrants attention before merging. The PR introduces a transitive dependency on github.com/rcrowley/go-metrics (v0.0.0-20250401214520-65e299d6c5c9), pulled in via gocloud.dev/pubsub/kafkapubsub@v0.46.0, which carries a BSD-2-Clause-Views license. This license variant is classified as 'non oss' due to an advertising clause-like restriction that may conflict with your project's open-source license policy. All other dependency changes are clean — no known vulnerabilities, no deprecated packages, and all other licenses are permissive (MIT, Apache-2.0, BSD-3-Clause). We strongly recommend having your legal or open-source compliance team review the BSD-2-Clause-Views license terms before merging. If the license is deemed incompatible, evaluate whether an alternative Kafka pub/sub integration exists that does not transitively pull in this package, or seek an explicit license exception. Note View full detailed analysis result for more information on the output and the checks that were run. Required Dependency Mitigations
Found this helpful? Give it a 👍 or 👎 reaction! |
|
Kusari PR Analysis rerun based on - 04a6114 performed at: 2026-06-23T14:33:10Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - 04a6114 performed at: 2026-06-23T17:25:08Z - link to updated analysis |
1 participant
Bumps gocloud.dev/pubsub/kafkapubsub from 0.40.0 to 0.46.0.
Release notes
Sourced from gocloud.dev/pubsub/kafkapubsub's releases.
... (truncated)
Commits
60f0d74all: prereleasea1725f0blob/s3blob: migrate from deprecated s3/manager to s3/transfermanager (#3717)7eadd65aws: add AWS IAM Role assumption support (#3716)054c82epostgres/awspostgres: add IAM authentication support (#3713)2b85c85docs: fix Pub/Sub subscribe wording (#3714)b9dee8dbuild: add top-level permissions restriction to tests workflow (#3711)45a8cfcdocstore: support unwrapping ActionListError for use with errors.Is (#3705)78b5976all: support typed errors and errors.Is for error codes (#3708)595f8b6all: update another otel dep (#3701)c903aefall: update otel deps (#3699)