Update module github.com/cenkalti/backoff/v5 to v7

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cenkalti/backoff/v5	v5.0.3 → v7.0.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

cenkalti/backoff (github.com/cenkalti/backoff/v5)

v7.0.0

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux-kflux-prd-rh02]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: github.com/openshift-hyperfleet/hyperfleet-sentinel/internal/client imports
	github.com/openshift-hyperfleet/hyperfleet-sentinel/pkg/api/openapi: cannot find module providing package github.com/openshift-hyperfleet/hyperfleet-sentinel/pkg/api/openapi

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign rh-amarin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

Modified go.mod to change the required version of github.com/cenkalti/backoff from v5.0.3 (module path v5) to v7.0.0 (module path v7). No source code, imports, or exported entities changed.

Estimated code review effort: 2 (Simple) | ~5 minutes

Changes

File	Change
go.mod	Dependency require line updated: github.com/cenkalti/backoff/v5 v5.0.3 → github.com/cenkalti/backoff/v7 v7.0.0

Supply chain note: Major version bump (v5→v7) — this is not a simple patch/minor update. A go.sum diff was not provided in this summary; verify checksum entries for the new module path were regenerated and that go.sum hash pinning is intact (CWE-1104, "Use of Unmaintained Third Party Components" applies if provenance of v7.0.0 isn't verified). Confirm no import paths in consuming code still reference /v5 — a mismatched major-version import path will fail to compile, not silently succeed, but verify CI actually exercises build+test rather than skipping on cache. No CVE specifically tied to backoff v5/v7 is asserted here — confirm via vulnerability database before merge.

Suggested labels: dependencies, go.mod

Suggested reviewers: Not enough information to assign meaningfully — check ownership of go.mod update policy for this repo.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	PASS: diff only changes go.mod; no non-test log calls interpolate token/password/credential/secret, so no CWE-532 leak.
No Hardcoded Secrets	✅ Passed	Touched file is only go.mod; no hardcoded secrets, embedded creds, or long base64 literals found (no CWE-798/CWE-259 indicators).
No Weak Cryptography	✅ Passed	Only go.mod changed to bump backoff; no banned primitives, custom crypto, or secret comparisons found (CWE-327/CWE-328).
No Injection Vectors	✅ Passed	No CWE-89/CWE-78/CWE-79/CWE-502 injection sink was added; the PR only bumps go.mod from backoff/v5 to v7.
No Privileged Containers	✅ Passed	PASS: Only go.mod changed; no manifests/Dockerfiles were touched, so no privileged-container settings were introduced (CWE-250).
No Pii Or Sensitive Data In Logs	✅ Passed	PASS: PR only changes go.mod; no slog/logr/zap/fmt.Print* diff lines, so CWE-532 logging leakage is not introduced.
Title check	✅ Passed	The title clearly identifies the dependency bump from backoff v5.0.3 to v7.0.0.
Description check	✅ Passed	The description matches the changeset and documents the same dependency version update.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/github.com-cenkalti-backoff-v5-7.x

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch konflux/mintmaker/main/github.com-cenkalti-backoff-v5-7.x

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 6: The module version has been bumped to github.com/cenkalti/backoff/v7,
but internal/client/client.go still references the old v5 import, so update that
import to v7 and regenerate go.sum so the build stays consistent. Make the
change in the client code that uses the backoff package, then refresh the
dependency sums to match the new go.mod requirement.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2d04c99e-5191-46e0-88d2-6b0676611482

📥 Commits

Reviewing files that changed from the base of the PR and between 9dd44f4 and 930c25e.

📒 Files selected for processing (1)

• go.mod

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual) → reviewed against open PR #280 konflux/mintmaker/main/github.com-cenkalti-backoff-v5-7.x instead of the default branch
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against open PR #228 konflux/mintmaker/main/github.com-cenkalti-backoff-v5-7.x instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual)

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n 'github.com/cenkalti/backoff/(v5|v7)' --glob '*.go' --glob 'go.mod' --glob 'go.sum' .

Repository: openshift-hyperfleet/hyperfleet-sentinel

Length of output: 496

---

Update the backoff import to v7 and regenerate sums (CWE-829).

internal/client/client.go still imports github.com/cenkalti/backoff/v5, so this go.mod bump to github.com/cenkalti/backoff/v7 will break the build until the source import is migrated and go.sum is refreshed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 6, The module version has been bumped to
github.com/cenkalti/backoff/v7, but internal/client/client.go still references
the old v5 import, so update that import to v7 and regenerate go.sum so the
build stays consistent. Make the change in the client code that uses the backoff
package, then refresh the dependency sums to match the new go.mod requirement.

Source: Path instructions

[rafabene]

Closing — waiting for Go 1.26 bump (HYPERFLEET-1311). Renovate will recreate with proper go.sum after the bump.

[rafabene]

/ok-to-test

[hyperfleet-ci-bot]

Risk Score: 0 — risk/low

Signal	Detail	Points
PR size	2 lines	+0
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}

[openshift-ci]

@red-hat-konflux-kflux-prd-rh02[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/presubmits-integration	12d3c88	link	true	/test presubmits-integration
ci/prow/unit	12d3c88	link	true	/test unit
ci/prow/lint	12d3c88	link	true	/test lint

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.