Skip to content

chore(deps): update test-tooling (9.4) - #8072

Open
elastic-renovate-prod[bot] wants to merge 1 commit into
9.4from
renovate/9.4-golang/test-tooling
Open

chore(deps): update test-tooling (9.4)#8072
elastic-renovate-prod[bot] wants to merge 1 commit into
9.4from
renovate/9.4-golang/test-tooling

Conversation

@elastic-renovate-prod

@elastic-renovate-prod elastic-renovate-prod Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
github.com/Shopify/toxiproxy/v2 require minor v2.12.0 → v2.13.0
github.com/testcontainers/testcontainers-go require minor v0.44.0 → v0.45.0
github.com/testcontainers/testcontainers-go/modules/toxiproxy require minor v0.44.0 → v0.45.0

Release Notes

testcontainers/testcontainers-go (github.com/testcontainers/testcontainers-go)

v0.45.0

Compare Source

What's Changed
⚠️ Breaking Changes

Client SDK dependencies have moved into separate examples modules. For CockroachDB, ConnectionConfig is now available through cockroachdbexamples.NewContainer(c) in modules/cockroachdb/examples. The parent’s ConnectionString and MustConnectionString now return PostgreSQL URLs instead of registered pgx handles, and importing the parent no longer registers the pgx SQL driver. Use the examples adapter to retain the previous SDK behavior, or configure the driver yourself.

For Dex, AddClient, RemoveClient, AddUser, and RemoveUser have moved from *dex.Container to dexexamples.NewAdminClient(c) in modules/dex/examples. Static configuration through WithClient and WithUser is unchanged.

For Cosmos DB, ContainerPolicy and NewContainerPolicy have moved from modules/azure/cosmosdb to modules/azure/examples/cosmosdb. Update the adapter import; its constructor still accepts the parent container. Run, Container, and ConnectionString remain unchanged in the parent module.

🔒 Security
🚀 Features
🐛 Bug Fixes
📖 Documentation
🧹 Housekeeping
📦 Dependency updates

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@elastic-renovate-prod
elastic-renovate-prod Bot requested a review from a team as a code owner October 19, 2026 21:37
@elastic-renovate-prod elastic-renovate-prod Bot added automation backport-skip Skip notification from the automated backport with mergify dependency labels Oct 19, 2026
@elastic-renovate-prod
elastic-renovate-prod Bot removed the request for review from a team October 19, 2026 21:37
@elastic-renovate-prod elastic-renovate-prod Bot added skip-changelog Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team labels Oct 19, 2026
@elastic-renovate-prod

elastic-renovate-prod Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: testing/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.26.10 -> 1.27.0
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c -> v0.0.0-20261006220739-8c912ac31dd4
github.com/docker/go-connections v0.7.0 -> v0.8.2
github.com/klauspost/compress v1.18.6 -> v1.18.7
github.com/magiconair/properties v1.8.10 -> v1.18.12
github.com/moby/go-archive v0.2.0 -> v0.3.3
github.com/moby/moby/client v0.5.0 -> v0.6.2
github.com/moby/sys/user v0.4.0 -> v0.4.1

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

Dependency Update Analysis

Summary: github.com/Shopify/toxiproxy/v2 was bumped from v2.12.0 to v2.13.0 (Go ecosystem). Release notes indicate mostly fixes/security-hardening improvements, but this PR also raises testing/go.mod to go 1.27.0 while repo .go-version is 1.26.9, which is a compatibility break in this branch context.

Dependency 1: github.com/Shopify/toxiproxy/v2 v2.12.0 → v2.13.0

Ecosystem: Go

Check Result
Breaking changes ⚠️ Found (toolchain compatibility impact below)
Testable in PR ✅ Yes (dependency is used in e2e test code paths runnable in CI/PR pipelines)
Changelog highlights (v2.12.0 → v2.13.0)

From https://github.com/Shopify/toxiproxy/releases/tag/v2.13.0:

  • Rejects invalid slicer toxic configs and prevents pathological recursion.
  • Adds optional bearer-token auth (TOXIPROXY_AUTH_TOKEN) for HTTP API and warning on unauthenticated non-loopback API.
  • Fixes hangs/freezes when removing toxics on gone downstream connections.
  • Fixes bandwidth toxic hang/panic for rate <= 0.
  • Upstream project updates Go version to 1.27.

Security/CVE view:

  • No explicit CVE/GHSA IDs were listed in the release notes.
  • Security posture appears improved (optional API auth + warning behavior), and stability fixes reduce DoS-like hang conditions in toxic handling paths.
  • No new attack surface relevant to Fleet Server runtime was identified from this bump (usage is test-only in this repo).
Usage in this repository

Direct usage is in e2e tests only:

  • testing/e2e/stand_alone_test.go:26 import github.com/Shopify/toxiproxy/v2/client
  • testing/e2e/stand_alone_container_test.go:20 import github.com/Shopify/toxiproxy/v2/client
  • APIs used include NewClient, Proxy("es"), AddToxic, RemoveToxic (e.g. stand_alone_test.go:120,151,153,158; stand_alone_container_test.go:143,159,163,168).
Compatibility assessment
  • API usage in Fleet tests (NewClient/Proxy/AddToxic/RemoveToxic) aligns with release-note changes; no direct API removal/regression was observed for consumed calls.
  • However, this PR also changes testing/go.mod from go 1.26.9 to go 1.27.0, while repo .go-version is still 1.26.9.
  • Verified locally:
    • go version → go1.26.9
    • cd testing && go list ./... fails with: go.mod requires go >= 1.27.0 (running go 1.26.9; GOTOOLCHAIN=local)

This is a concrete compatibility break for environments pinned to the repo toolchain version.

Labels Applied

No labels applied (oblt-aw/ai/merge-ready withheld due to compatibility break).

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

TL;DR

The E2E failure is isolated to TestStandAloneRunningSuite/TestOpAMPWithUpstreamCollector and appears to be a non-deterministic external dependency path, not a compile/runtime break from this PR’s toxiproxy client bump. Immediate action: retry the E2E job; if it reproduces, make the upstream collector build deterministic.

Remediation

  • Retry the failed Buildkite E2E step once to rule out transient upstream/network flake.
  • If it fails again, update testing/e2e/stand_alone_test.go to pin opentelemetry-collector-contrib to a fixed commit/tag (instead of cloning main) and rerun E2E.
  • Capture full verbose output for the failing subtest (current artifact is truncated and omits the assertion/error line).
Investigation details

Root Cause

Classified as Infrastructure / flaky test path.

Evidence points to an unstable external build dependency in the failing test:

  • testing/e2e/stand_alone_test.go:688-693 clones https://github.com/open-telemetry/opentelemetry-collector-contrib from main with shallow depth.
  • testing/e2e/stand_alone_test.go:705 builds via make otelcontribcol.
  • testing/e2e/stand_alone_test.go:759-761 then waits for enrollment with a bounded timeout.

This means test behavior can change independent of this PR when upstream main changes or when network/build conditions vary.

Evidence

  • Build: https://buildkite.com/elastic/fleet-server/builds/17648
  • Job/step: E2E Test (.buildkite/scripts/e2e_test.sh)
  • Key log excerpt:
    • --- FAIL: TestStandAloneRunningSuite/TestOpAMPWithUpstreamCollector (345.26s)
    • No detailed assertion/stack trace is present in the provided log artifact (/tmp/gh-aw/buildkite-logs/fleet-server-e2e-test.txt).

PR scope check:

  • Changed files are testing/go.mod and testing/go.sum (toxiproxy client bump).
  • The failing subtest is OpAMP upstream-collector flow, not one of the toxiproxy-focused tests.

Flaky-test issue check:

  • I checked for a matching open flaky-test issue for this specific failure and did not find an accessible match.

Verification

  • Local rerun in this environment: not run (Docker-in-Docker is unsupported here, so E2E reproduction is unavailable).
  • Static trace performed against:
    • PR diff
    • failing Buildkite log artifact
    • test source paths/line references above.

Follow-up

  • If desired, I can propose a minimal patch to pin the contrib collector ref (commit/tag) and add targeted logging around clone/build/enrollment failure boundaries.

What is this? | From workflow: Observability Agentic Workflow — Status

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@mergify

mergify Bot commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

This pull request is now in conflicts. Could you fix it @elastic-renovate-prod[bot]? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-golang/test-tooling upstream/renovate/9.4-golang/test-tooling
git merge upstream/9.4
git push upstream renovate/9.4-golang/test-tooling

@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-golang/test-tooling branch from 884f613 to b564778 Compare October 21, 2026 13:39
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Dependency Update Analysis

Summary: Updated github.com/Shopify/toxiproxy/v2 from v2.12.0 to v2.13.0 in testing/go.mod; overall risk is low-to-moderate due unavailable upstream release notes, but repo usage is test-only and compatible.

Dependency 1: github.com/Shopify/toxiproxy/v2 v2.12.0 → v2.13.0

Ecosystem: Go

Check Result
Breaking changes ✅ None found
Testable in PR ✅ Yes
Changelog highlights (v2.12.0 → v2.13.0)

Upstream release-note bodies were unavailable from this environment after fallback attempts:

  • GitHub MCP get_release_by_tag for both tags returned 403 (Shopify org IP allowlist).
  • Renovate commit metadata in this PR did not include release/compare URLs for web-fetch fallback.

Because no upstream notes were retrievable, I could not confirm specific CVE/GHSA entries from maintainers for this version pair.

Usage in this repository

The module is used in E2E test code (not production runtime):

  • testing/e2e/stand_alone_test.go:26 (client import)
  • testing/e2e/stand_alone_test.go:120,153,175,208,514,517 (NewClient, Proxy, AddToxic, RemoveToxic, Attributes)
  • testing/e2e/stand_alone_container_test.go:20,140,159 (same client API pattern)

Related test scaffold uses toxiproxy container image pins:

  • testing/e2e/scaffold/scaffold.go:691,704 (ghcr.io/shopify/toxiproxy:2.12.0)
Compatibility assessment
  • This is a minor Go module bump within major v2 (v2.12.0 → v2.13.0), so no Go import-path break is expected.
  • Consumed API surface in this repo is narrow (client.NewClient, proxy lookup, toxic add/remove), and no local call-site changes are needed from the diff.
  • The dependency is confined to test/e2e paths (testing/ module), so production Fleet Server behavior is not directly impacted.
  • PR testability is acceptable: Buildkite PR builds are enabled (.buildkite/pull-requests.json:9 build_on_commit: true) and test pipeline includes E2E execution (.buildkite/pipeline.yml:225 e2e_test.sh).

CVE-focused assessment: without upstream notes, no specific vulnerability fixes or regressions can be attributed. Given test-only usage and unchanged local API calls, residual security risk to runtime code remains low.

Labels Applied

  • oblt-aw/ai/merge-ready (applied): low-to-moderate risk, no breaking usage impact found, and dependency is test-only with PR-testable CI paths.

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Automerge skipped

Automerge skipped this pull request because the go-dependencies collection is not enabled for this repository.

To allow automerge for this kind of update, enable the matching collection under Automerge on the Control Plane Dashboard (the oblt-aw/dashboard issue). See Automerge dependency collections for what each collection covers.

See Opt in or opt out for how to enable or disable Automerge collections on the Control Plane Dashboard.

Collections currently enabled for automerge: github-actions, pre-commit, vm-images

Changed files considered:

  • testing/go.mod
  • testing/go.sum

@elastic-renovate-prod elastic-renovate-prod Bot changed the title Update module github.com/Shopify/toxiproxy/v2 to v2.13.0 (9.4) chore(deps): update module github.com/shopify/toxiproxy/v2 to v2.13.0 (9.4) Oct 28, 2026
@elastic-renovate-prod elastic-renovate-prod Bot changed the title chore(deps): update module github.com/shopify/toxiproxy/v2 to v2.13.0 (9.4) chore(deps): update test-tooling (9.4) Nov 5, 2026
@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-golang/test-tooling branch from b564778 to 069bc0b Compare November 5, 2026 21:37
Copilot AI balanced review requested due to automatic review settings November 5, 2026 21:38
Copilot AI reviewed Nov 5, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are reported for the test-tooling dependency and minimum Go version updates.

No open issues 🎉

What changed in this PR

Updates Fleet Server’s test-tooling dependencies for the 9.4 branch, refreshing the libraries used by container-based tests.

Changes:

  • Upgrades Toxiproxy to v2.13.0 and Testcontainers Go and its Toxiproxy module to v0.45.0.
  • Raises the testing module’s minimum Go version from 1.26.10 to 1.27.0.
  • Refreshes transitive dependencies and checksums.
File Description
testing/​go.sum Updates dependency checksums and removes obsolete entries.
testing/​go.mod Updates test-tooling dependencies and the minimum Go version.

Review effort: Balanced

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

Dependency Update Analysis

Summary: This PR updates Go test dependencies in testing/go.mod; dependency compatibility is mostly fine, but the testing module now requires Go 1.27.0 while repo tooling is still pinned to 1.26.10, so overall risk is moderate.

Dependency: github.com/testcontainers/testcontainers-go / modules/toxiproxy v0.44.0 → v0.45.0

Ecosystem: Go

Check Result
Breaking changes ✅ None found for this repo usage
Testable in PR ✅ Yes (Buildkite PR pipeline runs on commit)
Changelog highlights (v0.44.0 → v0.45.0)
  • Upstream release includes module-level breaking changes for CockroachDB/Dex/Cosmos adapters, but this repo does not import those modules.
  • Security-related upstream note: dependency security upgrades (e.g., otel log sdk).
  • Multiple wait/network/runtime fixes in testcontainers core that align with this repo’s E2E container orchestration paths.
Usage in this repository
  • testing/e2e/agent_container_test.go (e.g., testcontainers.ContainerRequest, GenericContainer, Endpoint)
  • testing/e2e/stand_alone_container_test.go (container startup + PortEndpoint)
  • testing/e2e/remote_es_output_test.go (parallel container orchestration)
  • testing/e2e/scaffold/scaffold.go (modules/toxiproxy helper via toxitc.Run)
Compatibility assessment
  • Local usage is focused on core container APIs and toxiproxy module wiring; no imports of modules called out in upstream breaking changes were found.
  • No consumed API/input in these files appears removed or renamed by the update.
  • Security-impacting changes are confined to test infrastructure paths (E2E/dev testing), not production runtime code.

Dependency: github.com/Shopify/toxiproxy/v2 v2.12.0 → v2.13.0

Ecosystem: Go

Check Result
Breaking changes ✅ None found in local usage
Testable in PR ✅ Yes (Buildkite PR pipeline runs on commit)
Changelog highlights (v2.12.0 → v2.13.0)
  • Upstream release-note body was unavailable from MCP due Shopify org IP allow-list restrictions after retry/fallback attempts.
  • Local PR metadata confirms the exact version bump only.
Usage in this repository
  • testing/e2e/stand_alone_container_test.go and testing/e2e/stand_alone_test.go use toxiproxy.NewClient, Proxy("es"), AddToxic, RemoveToxic.
Compatibility assessment
  • This repo uses a narrow client surface (create client + add/remove toxic); no local evidence of incompatible interface changes in this PR.
  • Residual uncertainty remains because upstream notes were inaccessible from this environment.

Toolchain requirement change: testing/go.mod Go 1.26.10 → 1.27.0

Ecosystem: Go

Check Result
Breaking changes ⚠️ Found (toolchain mismatch)
Testable in PR ✅ Yes (Buildkite PR pipeline runs on commit)
Changelog highlights (toolchain pin)
  • testing/go.mod now requires go 1.27.0.
  • Repo root still pins .go-version to 1.26.10.
Usage in this repository
  • testing module is used for E2E/integration test infrastructure.
  • In this environment (go1.26.10), cd testing && go list ./... fails with: go.mod requires go >= 1.27.0.
Compatibility assessment
  • This is a concrete compatibility break for contributors/automation still using .go-version/local toolchain 1.26.10.
  • Unless test environments auto-upgrade toolchains, this may block test tooling execution in the testing module.

Labels Applied

No labels applied (overall risk assessed as moderate due toolchain mismatch and confirmed local failure under the repo’s current pinned Go version).

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@mergify

mergify Bot commented Nov 6, 2026

Copy link
Copy Markdown
Contributor

This pull request is now in conflicts. Could you fix it @elastic-renovate-prod[bot]? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-golang/test-tooling upstream/renovate/9.4-golang/test-tooling
git merge upstream/9.4
git push upstream renovate/9.4-golang/test-tooling

@elastic-renovate-prod
elastic-renovate-prod Bot force-pushed the renovate/9.4-golang/test-tooling branch from 069bc0b to 4725c0b Compare November 6, 2026 13:38
Copilot AI balanced review requested due to automatic review settings November 6, 2026 13:38
Copilot AI reviewed Nov 6, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The testing module requires Go 1.27 while E2E jobs provision Go 1.26.10, risking test failures when automatic toolchain switching is disabled or the newer toolchain cannot be downloaded.

1 open issue

Review effort: Balanced

Comment thread testing/go.mod
module github.com/elastic/fleet-server/testing

go 1.26.10
go 1.27.0
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2026

Copy link
Copy Markdown
Contributor

Dependency Update Analysis

Summary: This PR updates Go test-only dependencies, but it also raises testing/go.mod to go 1.27.0, which is incompatible with the repository’s pinned toolchain (1.26.10) in this environment (GOTOOLCHAIN=local). Overall risk: high until toolchain alignment is addressed.

Go toolchain floor: go 1.26.10 → 1.27.0 (testing/go.mod)

Ecosystem: Go

Check Result
Breaking changes ⚠️ Found — testing module no longer builds with repo-pinned Go 1.26.10
Testable in PR ⚠️ Blocked — compile fails under current pinned toolchain
Changelog highlights (1.26.10 → 1.27.0)

No upstream release-note body was available from local PR metadata for this toolchain floor bump.

Usage in this repository
  • testing/go.mod:3 now requires go 1.27.0.
  • E2E tests run from this module via Mage (magefile.go:2148-2157, cmd.Dir = "testing", go test ./...).
  • Repo baseline still pins Go 1.26.10 (.go-version:1, go.mod:3).
  • Repro: cd testing && go test ./... -run TestDoesNotExist -count=1 → go.mod requires go >= 1.27.0 (running go 1.26.10; GOTOOLCHAIN=local).
Compatibility assessment

This is a real compatibility break for contributors/CI lanes using the repository-pinned Go toolchain. Unless CI for this PR explicitly upgrades Go for testing-module commands, E2E-related validation will fail.

github.com/testcontainers/testcontainers-go v0.44.0 → v0.45.0 (and modules/toxiproxy v0.45.0)

Ecosystem: Go

Check Result
Breaking changes ✅ None found for the APIs used here
Testable in PR ✅ Yes (once toolchain mismatch above is resolved)
Changelog highlights (v0.44.0 → v0.45.0)

Release notes include module-specific breaking changes (CockroachDB/Dex example adapters), plus bug fixes and a security dependency upgrade (otel log SDK). No listed break targets the GenericContainer/wait/toxiproxy module usage present in this repo.

Usage in this repository
  • testing/e2e/scaffold/scaffold.go imports testcontainers-go + modules/toxiproxy and uses GenericContainer, ContainerRequest, custom request/network config, and toxiproxy module container startup.
  • testing/e2e/stand_alone_container_test.go and other E2E tests use container lifecycle and port endpoint APIs.
Compatibility assessment

Used APIs are stable relative to reported v0.45.0 breaking items; no direct incompatibility found from local usage.

github.com/Shopify/toxiproxy/v2 v2.12.0 → v2.13.0

Ecosystem: Go

Check Result
Breaking changes ✅ None found in repo usage
Testable in PR ✅ Yes (once toolchain mismatch above is resolved)
Changelog highlights (v2.12.0 → v2.13.0)

Upstream release/tag metadata could not be retrieved from GitHub MCP due upstream org IP allowlist restrictions for Shopify/toxiproxy; local PR metadata did not include release-note content.

Usage in this repository
  • testing/e2e/stand_alone_container_test.go and testing/e2e/stand_alone_test.go use toxiproxy/client (NewClient, Proxy, AddToxic, RemoveToxic) for network-failure simulation.
Compatibility assessment

No local code changes are needed for current client calls based on this diff; impact appears contained to E2E test tooling.

Labels Applied

No labels applied (overall risk is above low/low-to-moderate due toolchain compatibility break).

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@blakerouse blakerouse Awaiting requested review from blakerouse blakerouse is a code owner automatically assigned from elastic/elastic-agent-control-plane

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

automation backport-skip Skip notification from the automated backport with mergify dependency oblt-aw/ai/merge-ready skip-changelog Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant