Update module github.com/cenkalti/backoff/v5 to v7

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cenkalti/backoff/v5	v5.0.3 → v7.0.0

---

Release Notes

cenkalti/backoff (github.com/cenkalti/backoff/v5)

v7.0.0

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign vkareh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

Supply chain change: indirect dependency github.com/cenkalti/backoff bumped from v5.0.3 to v7.0.0 — a two-major-version jump on a transitive package pulled into a Go-based K8s platform component. No corresponding go.sum diff provided for verification. Major version jumps in transitive deps can introduce breaking API/behavioral changes not visible in this single-line diff; supply chain provenance for the new module (checksum/signature) is not confirmed here.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

No sequence diagram generated — single dependency version bump, no multi-component control flow change.

Security Notes:

• CWE-1104 (Use of Unmaintained Third Party Components) — verify v7.0.0 provenance and maintenance status before merge.
• Confirm go.sum hash updated and matches official module checksum (GONOSUMCHECK/GOSUMDB verification) — not included in this diff.
• Two-major-version jump (v5→v7) skips v6 entirely; audit changelog for breaking changes / removed APIs affecting retry logic in Adapter.

Suggested labels: dependencies, go.mod, needs-gosum-verification

Suggested reviewers: platform-supply-chain-owner

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	PR changes only go.mod; no .go log statements were modified, so no token/password/credential/secret logging issue (CWE-532).
No Hardcoded Secrets	✅ Passed	Only go.mod changed, and the diff is a dependency bump; no hardcoded secrets, creds, base64 blobs, or URL auth found (CWE-798).
No Weak Cryptography	✅ Passed	go.mod only bumps backoff v5→v7; no crypto/md5, crypto/des, crypto/rc4, SHA1-for-security, ECB, or timing-unsafe secret compares found (CWE-327/CWE-208).
No Injection Vectors	✅ Passed	Only go.mod changed; no SQL concatenation, exec.Command, template.HTML, or yaml.Unmarshal paths were added. No CWE-89/78/79/502 injection vector.
No Privileged Containers	✅ Passed	Only go.mod changed; no manifests/templates/Dockerfiles were modified, so no privileged-container settings were introduced (CWE-250/CWE-732).
No Pii Or Sensitive Data In Logs	✅ Passed	PASS: PR only updates go.mod dependency metadata; no logging code or new log statements were changed, so no CWE-532 exposure.
Title check	✅ Passed	The title matches the main change: bumping github.com/cenkalti/backoff from v5 to v7.
Description check	✅ Passed	The description directly documents the same dependency version update reflected in the diff.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/github.com-cenkalti-backoff-v5-7.x

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch konflux/mintmaker/main/github.com-cenkalti-backoff-v5-7.x

---

_{Comment @coderabbitai help to get the list of available commands.}