chore(deps): bump go mod github.com/pingcap/tiflow by ti-chi-bot · Pull Request #5495 · pingcap/ticdc

ti-chi-bot · 2026-06-24T10:47:17Z

What problem does this PR solve?

Auto generated by bot.
Issue Number: ref #1074

Release note

None

Summary by CodeRabbit

Chores
- Updated Go dependencies to newer versions for improved maintenance and compatibility.
- Refreshed several core PingCAP database components by advancing related revisions (including kvproto, TiDB, TiDB parser, and TiFlow), while leaving some packages unchanged.
- Bumped select transitive libraries (including telemetry and cryptography) to align with newer versions.

ti-chi-bot · 2026-06-24T10:47:24Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kennytm for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-06-24T10:47:33Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

go.mod updates four direct PingCAP dependency revisions and five indirect dependency versions, while retaining unchanged direct dependencies.

Changes

Dependency Version Bumps

Layer / File(s)	Summary
go.mod dependency updates `go.mod`	Advances `kvproto`, `tidb`, `tidb/pkg/parser`, and `tiflow`; bumps indirect `edwards25519`, `grpc-gateway/v2`, `tipb`, `go-m1cpu`, and `otlp`.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Poem

🐇 Through go.mod I softly hop,
Fresh revisions never stop.
Direct and indirect friends align,
Each dependency gets its shine.
A tidy update, neat and bright!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	It includes the problem, issue reference, and release note, but misses the change summary, checklist/tests, and question sections from the template.	Add the missing sections: what changed and how it works, checklist/tests, compatibility/doc questions, and confirm the release note if applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the dependency bump and matches the main change to go.mod.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/master/update-dep-tiflow

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist

Code Review

This pull request updates several Go dependencies in go.mod and go.sum, including github.com/pingcap/kvproto, github.com/pingcap/tidb, github.com/pingcap/tiflow, and other packages to their newer versions. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 58: The TiDB dependency bump is unsafe because the current
github.com/pingcap/tidb version is known to be affected by multiple advisories.
Update the go.mod dependency to a patched TiDB release that addresses
GHSA-7fxj-fr3v-r9gj, GHSA-9g6g-xqv5-8g5w, and GO-2024-3284, or otherwise add
explicit justification for why this upgrade is exempt. Locate the change at the
github.com/pingcap/tidb entry in go.mod and keep the version aligned with any
related transitive updates.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4fbb2766-d814-443e-9fb7-f7b9e9cf2f6c

📥 Commits

Reviewing files that changed from the base of the PR and between 5d5121d and f1edf7c.

⛔ Files ignored due to path filters (1)

go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

go.mod

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 58: Update the github.com/pingcap/tidb dependency version to a patched
revision that is not affected by GO-2024-3284, GHSA-7fxj-fr3v-r9gj, or
GHSA-9g6g-xqv5-8g5w; if upgrading is not applicable, document the concrete
justification for this usage instead.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ac63780a-7801-4ac0-ae3e-193aabb0d128

📥 Commits

Reviewing files that changed from the base of the PR and between f42a9d0 and 30b8bcc.

⛔ Files ignored due to path filters (1)

go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

go.mod

coderabbitai

♻️ Duplicate comments (1)

go.mod (1)
58-58: ⚠️ Potential issue | 🔴 Critical

Do not retain this TiDB revision without resolving the existing advisory finding.

Line 58 still pins the exact TiDB pseudo-version previously flagged for GO-2024-3284, GHSA-7fxj-fr3v-r9gj, and GHSA-9g6g-xqv5-8g5w. The Go vulnerability database lists custom TiDB versions before v8.2.0 as affected, with v8.2.0 identified as the patched version for the nil-pointer issue. (pkg.go.dev)

Update to a patched revision, or document and verify that the vulnerable symbols are unreachable from ticdc.
#!/usr/bin/env bash
set -euo pipefail

go list -m -f '{{.Path}} {{.Version}}' github.com/pingcap/tidb
govulncheck ./...
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 58, Update the github.com/pingcap/tidb dependency from the
flagged pseudo-version to a patched release or revision at least equivalent to
v8.2.0, then regenerate module metadata and verify with govulncheck ./.... If
retaining the older revision, document and validate that the vulnerable symbols
are unreachable from ticdc.
Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@go.mod`:
- Line 58: Update the github.com/pingcap/tidb dependency from the flagged
pseudo-version to a patched release or revision at least equivalent to v8.2.0,
then regenerate module metadata and verify with govulncheck ./.... If retaining
the older revision, document and validate that the vulnerable symbols are
unreachable from ticdc.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7d5c2c21-fa3c-405d-a537-81ab6b3c2a1c

📥 Commits

Reviewing files that changed from the base of the PR and between 7b79663 and d70e0a0.

⛔ Files ignored due to path filters (1)

go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

go.mod

ti-chi-bot Bot added the release-note-none Denotes a PR that doesn't merit a release note. label Jun 24, 2026

ti-chi-bot Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jun 24, 2026

gemini-code-assist Bot reviewed Jun 24, 2026

View reviewed changes

coderabbitai Bot reviewed Jun 24, 2026

View reviewed changes

Comment thread go.mod Outdated

ti-chi-bot force-pushed the fix/master/update-dep-tiflow branch 2 times, most recently from f42a9d0 to 2abe2e1 Compare June 29, 2026 13:25

ti-chi-bot force-pushed the fix/master/update-dep-tiflow branch from 2abe2e1 to 30b8bcc Compare July 15, 2026 08:03

coderabbitai Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread go.mod

ti-chi-bot force-pushed the fix/master/update-dep-tiflow branch 2 times, most recently from 7b79663 to d70e0a0 Compare July 16, 2026 10:30

coderabbitai Bot reviewed Jul 16, 2026

View reviewed changes

ti-chi-bot force-pushed the fix/master/update-dep-tiflow branch 2 times, most recently from 33bf4e0 to a733f2b Compare July 22, 2026 08:25

chore(deps): bump go mod github.com/pingcap/tiflow

e7409bf

ti-chi-bot force-pushed the fix/master/update-dep-tiflow branch from a733f2b to e7409bf Compare July 23, 2026 07:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump go mod github.com/pingcap/tiflow#5495

chore(deps): bump go mod github.com/pingcap/tiflow#5495
ti-chi-bot wants to merge 1 commit into
masterfrom
fix/master/update-dep-tiflow

ti-chi-bot commented Jun 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

ti-chi-bot Bot commented Jun 24, 2026

Uh oh!

coderabbitai Bot commented Jun 24, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ti-chi-bot commented Jun 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What problem does this PR solve?

Release note

Summary by CodeRabbit

Uh oh!

ti-chi-bot Bot commented Jun 24, 2026

Uh oh!

coderabbitai Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ti-chi-bot commented Jun 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 24, 2026 •

edited

Loading