Repository navigation
chore(deps): bump go.uber.org/zap from 1.27.0 to 1.28.0 - #6241
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [go.uber.org/zap](https://github.com/uber-go/zap) from 1.27.0 to 1.28.0. - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.27.0...v1.28.0) --- updated-dependencies: - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the Zap v1.28.0 dependency and vendor update.
No open issues 🎉
What changed in this PR
Updates Fluid’s Zap logging dependency from v1.27.0 to v1.28.0 and synchronizes the vendored source.
Changes:
- Updates the module version, checksums, and vendor metadata.
- Includes upstream logging fixes, pre-write hooks, and the
DictObjecthelper. - Refreshes upstream documentation, license metadata, and lint configuration.
| File | Description |
|---|---|
vendor/modules.txt |
Records Zap v1.28.0. |
vendor/go.uber.org/zap/zapcore/level.go |
Adds the warning level alias and simplifies parsing cases. |
vendor/go.uber.org/zap/zapcore/lazy_with.go |
Updates lazy initialization and concurrent core access. |
vendor/go.uber.org/zap/zapcore/entry.go |
Adds hooks to transform entries and fields before writing. |
vendor/go.uber.org/zap/zapcore/console_encoder.go |
Explicitly discards formatting return values. |
vendor/go.uber.org/zap/zapcore/buffered_write_syncer.go |
Moves shutdown waiting outside the lock to avoid deadlock. |
vendor/go.uber.org/zap/sink.go |
Corrects the method name in a comment. |
vendor/go.uber.org/zap/options.go |
Explicitly discards diagnostic formatting return values. |
vendor/go.uber.org/zap/Makefile |
Adds an explicit package pattern to lint commands. |
vendor/go.uber.org/zap/logger.go |
Explicitly discards diagnostic formatting return values. |
vendor/go.uber.org/zap/LICENSE |
Updates the upstream copyright year range. |
vendor/go.uber.org/zap/http_handler.go |
Explicitly discards error-response formatting return values. |
vendor/go.uber.org/zap/field.go |
Handles nil object marshalers and adds DictObject. |
vendor/go.uber.org/zap/CODE_OF_CONDUCT.md |
Changes reference links to HTTPS. |
vendor/go.uber.org/zap/CHANGELOG.md |
Adds release notes for v1.27.1 and v1.28.0. |
vendor/go.uber.org/zap/.golangci.yml |
Corrects the nilness analyzer name. |
go.sum |
Updates Zap module checksums. |
go.mod |
Requires Zap v1.28.0. |
Review effort: Balanced
cheyang
left a comment
cheyang
left a comment
There was a problem hiding this comment.
Both reviewers independently verified this Dependabot bump of go.uber.org/zap 1.27.0 → 1.28.0 (go.mod/go.sum/vendor only — no fluid source touched) and converged on the same verdict: it's clean. The vendored tree is byte-identical to upstream v1.28.0 with a checksum-DB-matched go.sum, go.mod/go.sum/vendor/modules.txt agree with zero go mod tidy drift, and the whole repo builds. Fluid's actual zap usage — the logger chain in every cmd binary and controller-runtime's logger — is untouched by the upstream changes, and level-string acceptance strictly grew (the removed uppercase cases are covered by the existing ToLower fallback). The 1.27.1 fixes the PR cites are demonstrably present: contract tests panic on nil Object and reject the "warning" alias on the merge-base and pass on the head, on both verification branches. Six unit-test packages fail locally, but the identical set fails on the merge-base too — that's the environment (missing ddc-helm binary, fake-client/mount fixtures), not this PR; GitHub CI is green. Copilot (Reviewer C) also reviewed this head and raised no findings. No disagreement survived cross-critique — the only notes exchanged were provenance corrections, now adopted: both minor items are pre-existing, not PR-introduced.
Next round
[MUST] (none — no PR-introduced blockers; the merge checklist is green)
[SHOULD] After merge, uplift the zapcompat contract tests (level superset, nil-Object, vendor fidelity) so future zap bumps carry the compatibility guard (F2)
[Filed] (none)
Non-blocking observations (2) — not part of this round's ask; fix now, follow up, or file an issue as you see fit
- pkg/utils/helm:1 [minor] — pre-existing, not introduced by this PR — local unit-suite failures are not PR-attributed (identical on merge-base)
F1: Running the full unit suite (115 packages) locally, 6 packages fail (TestAlluxio, TestCacheEngine, TestDestroyWorker x2, TestCheckMountPointBroken, TestHelm) — but the byte-identical failing set also fails on the merge-base commit, so these are local-environment failures (the missing executable is fluid's ddc-helm wrapper, plus fake-client/mount fixture signatures), not regressions from this bump. Recorded so later rounds do not mis-attribute them; never gating. Consensus: proposed by Claude, independently reproduced on base and head by Codex; the missing-executable detail (ddc-helm, not helm) is Codex's correction, adopted. Provenance is carried by origin: preexisting / introducedByPR: false (firstSeenSha stays the reviewed head per the initial-round ledger contract). - go.mod:76 [minor] — pre-existing, not introduced by this PR — no in-repo guard for zap upgrade compatibility
F2: fluid vendors zap and bumps it regularly via Dependabot, but nothing in the repo's own suite would notice if a future bump dropped behavior the runtime depends on. This round's harness (pkg/utils/zapcompat: fluid logger-path smoke, level-superset guard, nil-object guard, go.mod<->modules.txt consistency, plus scripts/verify-vendor-fidelity.sh) is the guard and is a test-uplift candidate after merge. Consensus on the facts: Codex verified no non-vendor code references zapcore.Level/UnmarshalText, that the 12 zap-mentioning test files only construct loggers via controller-runtime's wrapper, and — sharpening the scope — that no fluid binary reaches zapcore.Level.UnmarshalText at runtime (the 11 cmd apps never call zap.Options.BindFlags, so there is no --zap-log-level flag). The absent guard is a standing repo characteristic that predates and passes through this bump (adjudicated pre-existing per Codex's critique, correcting Claude's initial introducedByPR: true); today it would only protect hypothetical future call sites. Non-blocking: the PR is a dependency bump, not a functional change, and CI's full unit suite covers the status quo.
Verified review delta
- F1: open (preexisting)
- F2: open (preexisting)
Code: clear. CI: success; attribution: baseline. Required CI checks still apply.
Bumps go.uber.org/zap from 1.27.0 to 1.28.0.
Release notes
Sourced from go.uber.org/zap's releases.
Changelog
Sourced from go.uber.org/zap's changelog.
Commits
5b81b37release v1.28.0 (#1547)0ab0d5azapcore: Add PreWriteHook for transforming entries before write (#1534)d278c59[chore] CI: test on Go 1.26 (#1535)16fb16bchore(dep): replace archived gopkg.in/yaml.v3 with officially maintained go.y...7b755a3release 1.27.1 (#1521)d6b395bUpdate lazy logger not to materialize unless it's being written to (#1519)4b9cea0ci: Test with Go 1.24, Go 1.25 (#1508)7c80d7bFix race condition in WithLazy implementation (#1426) (#1511)07077a6Prevent zap.Object from panicing on nils (#1501)a6afd05Fix lint check name (#1502)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)