chore: blocked - no usable tlsx tag to require - #2584
Conversation
tlsx v1.3.1 and v1.3.2 are cached in the Go module proxy but their tags
were deleted from GitHub, so anyone whose GOPRIVATE or GONOSUMDB routes
projectdiscovery modules around the proxy cannot resolve them:
go: github.com/projectdiscovery/tlsx@v1.3.2: invalid version:
unknown revision v1.3.2
v1.3.0 is a live tag whose commit is a descendant of the one v1.3.2
pointed at, so this loses nothing - the two share an identical go.mod
hash.
Claude-Session: https://claude.ai/code/session_015AKXsNzjd3HjGMq4B8JCNH
Claude-Local-Session: claude --resume 0fe5b680-5ba5-43e6-b354-43d4388aaf9c
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Essentials Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. WalkthroughThe pull request downgrades the direct ChangesDependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This updates the tlsx dependency to an available tag and supplied validation confirms the project resolves and passes its checks. No current merge-blocking risk is identified. Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
go.sum still carried hashes for the version that was replaced, which left the module graph inconsistent and failed lint with "no go files to analyze: running `go mod tidy` may solve the problem". Claude-Session: https://claude.ai/code/session_015AKXsNzjd3HjGMq4B8JCNH Claude-Local-Session: claude --resume 0fe5b680-5ba5-43e6-b354-43d4388aaf9c
Blocked on
Change
devcannot be built by anyone whoseGOPRIVATEroutes projectdiscovery modules around the Go proxy: it requirestlsx v1.3.2, a tag deleted from GitHub (invalid version: unknown revision v1.3.2).Evidence
The v1.3.x line is broken two ways. v1.3.1 and v1.3.2 are absent from GitHub but cached in the proxy. v1.3.0 is worse: the proxy and sumdb recorded commit
0fad45b, while GitHub's tag now points atcd755a6- the tag was moved after publication.So CI fails with
verifying github.com/projectdiscovery/tlsx@v1.3.0: checksum mismatch ... SECURITY ERROR. Recording either hash breaks the other audience, so no edit here can fix it. v1.2.2 is consistent and unaffected.Still open
retractblock for v1.3.0/.1/.2 would stop them being selected again.Claude-Session: https://claude.ai/code/session_015AKXsNzjd3HjGMq4B8JCNH
Claude-Local-Session: claude --resume 0fe5b680-5ba5-43e6-b354-43d4388aaf9c