Skip to content

Update module gopkg.in/evanphx/json-patch.v4 to v5 #1638

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
red-hat-konflux wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Open

Update module gopkg.in/evanphx/json-patch.v4 to v5 #1638

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ require (
google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260511170946-3700d4141b60 // indirect
google.golang.org/grpc v1.81.1 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/evanphx/json-patch.v5 v5.9.11 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Identify why both gopkg.in and github.com paths exist for json-patch

# Check which dependencies require each path
echo "=== Dependencies requiring gopkg.in/evanphx/json-patch.v5 ==="
go mod graph | grep 'gopkg.in/evanphx/json-patch.v5'

echo -e "\n=== Dependencies requiring github.com/evanphx/json-patch/v5 ==="
go mod graph | grep 'github.com/evanphx/json-patch/v5'

echo -e "\n=== All references to json-patch in go.mod graph ==="
go mod graph | grep -i 'json-patch'

Repository: openshift/lightspeed-operator

Length of output: 1487

🌐 Web query:

What is the correct import path for evanphx/json-patch v5? Is it gopkg.in/evanphx/json-patch.v5 or github.com/evanphx/json-patch/v5?

💡 Result:

The correct import path for evanphx/json-patch v5 is github.com/evanphx/json-patch/v5 [1][2]. According to the official project repository and documentation, you should use the following command to retrieve the library [1][3]: go get -u github.com/evanphx/json-patch/v5 The project previously used gopkg.in paths for versioning (e.g., gopkg.in/evanphx/json-patch.v4), but moved to the standard Go module structure using the /v5 suffix in the GitHub path [2][4]. Using the github.com/evanphx/json-patch/v5 path is the modern, recommended approach for all current versions [1][2][3].

Citations:

Remove the redundant gopkg.in/evanphx/json-patch.v5 requirement and keep only github.com/evanphx/json-patch/v5
go.mod currently includes both gopkg.in/evanphx/json-patch.v5 v5.9.11 (line 117) and github.com/evanphx/json-patch/v5 v5.9.11 (existing entry). go mod graph shows only the root module pulls in the gopkg.in path; other deps require the github.com/.../v5 path. The project/docs for v5 recommend github.com/evanphx/json-patch/v5, so adding gopkg.in/.../v5 contradicts the stated “removed gopkg.in references” note.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 117, Remove the redundant gopkg.in module requirement and
keep only the canonical github module: delete the gopkg.in/evanphx/json-patch.v5
v5.9.11 entry from go.mod, ensure github.com/evanphx/json-patch/v5 v5.9.11
remains, then run go mod tidy (or otherwise update module files) so the
go.sum/go.mod are consistent and no gopkg.in reference remains.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Search for direct imports or usage of json-patch in the codebase

echo "=== Searching for json-patch imports ==="
rg -n --type=go 'import.*json-patch' -C2

echo -e "\n=== Searching for json-patch package usage ==="
rg -n --type=go 'jsonpatch\.' -C2

echo -e "\n=== Searching for gopkg.in/evanphx/json-patch imports ==="
rg -n --type=go 'gopkg\.in/evanphx/json-patch' -C2

echo -e "\n=== Searching for github.com/evanphx/json-patch imports ==="
rg -n --type=go 'github\.com/evanphx/json-patch' -C2

Repository: openshift/lightspeed-operator

Length of output: 282

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== go.mod lines 100-140 ==="
nl -ba go.mod | sed -n '100,140p'

echo
echo "=== Search for json-patch references in entire repo ==="
rg -n 'json-patch|evanphx/json-patch|gopkg\.in/evanphx/json-patch|jsonpatch\.' -S

echo
echo "=== Search for module name in go.mod/go.sum specifically ==="
rg -n 'evanphx/json-patch|gopkg\.in/evanphx/json-patch' go.mod go.sum || true

echo
echo "=== Check if `go` tool is available (for `go mod why`) ==="
if command -v go >/dev/null 2>&1; then
  go version
  echo "=== go mod why gopkg.in/evanphx/json-patch ==="
  go mod why -m gopkg.in/evanphx/json-patch || true
else
  echo "go not available in this sandbox"
fi

Repository: openshift/lightspeed-operator

Length of output: 163

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== go.mod lines 100-140 (no nl available) ==="
awk 'NR>=100 && NR<=140 {printf "%d\t%s\n", NR, $0}' go.mod

echo
echo "=== Search for json-patch references in entire repo ==="
rg -n 'json-patch|evanphx/json-patch|gopkg\.in/evanphx/json-patch|jsonpatch\.' -S || true

echo
echo "=== Search for module name in go.mod/go.sum specifically ==="
rg -n 'evanphx/json-patch|gopkg\.in/evanphx/json-patch' go.mod go.sum || true

echo
echo "=== Check if `go` tool is available (for `go mod why`) ==="
if command -v go >/dev/null 2>&1; then
  go version
  echo "=== go mod why gopkg.in/evanphx/json-patch ==="
  go mod why -m gopkg.in/evanphx/json-patch || true
else
  echo "go not available in this sandbox"
fi

Repository: openshift/lightspeed-operator

Length of output: 16808

json-patch v4→v5 upgrade: no direct usage in this repo; only transitive risk remains.

  • Searches show no Go source imports/usages of json-patch/evanphx/json-patch (only go.mod/go.sum references).
  • go.mod includes gopkg.in/evanphx/json-patch.v5 v5.9.11 // indirect (and github.com/evanphx/json-patch/v5 v5.9.11 // indirect), so impact is via transitive dependencies only.
  • Run the usual unit/integration tests to catch any transitive incompatibilities from the major bump.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 117, The go.mod shows an indirect upgrade to
gopkg.in/evanphx/json-patch.v5 (gopkg.in/evanphx/json-patch.v5 v5.9.11 and
github.com/evanphx/json-patch/v5 v5.9.11) but there are no direct imports in the
repo; run a full dependency scan (go list -m all / search for
evanphx/json-patch) to confirm no direct usage, then run the complete test
matrix (unit and integration tests) to detect transitive breakages; if tests
fail, identify the dependent module pulling in json-patch.v5 and either update
that dependency to a compatible version or pin json-patch back to v4 via a
replace directive or vendor the compatible module until the transitive
dependency is fixed.

gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
Expand Down