jason810496 opened a new pull request, #70914: URL: https://github.com/apache/airflow/pull/70914
## Why The Go SDK's dependencies resolve directly to upstream repositories. Unlike PyPI or npm, there is no central registry that pre-scans a release before it is published, and whoever controls a module's namespace can cut a release at any time. The recent `slogcolor` incident (dangling namespace taken over after the original author deleted the repo, removed in #70824) is exactly this failure mode: a routine Dependabot version bump of a hijacked module would land malicious code in contributors' dev environments and CI before anyone reviewed it. Go's checksum database (`go.sum` + `sum.golang.org`) makes existing pins immutable, so the risk is not the *current* pin — it is the *next* automatic bump. ## What For the `gomod` ecosystem rooted at `/go-sdk`: - **Default branch:** disable automatic version-update PRs (`open-pull-requests-limit: 0`) and keep only the advisory-driven `go-sdk-security-updates` group. Dependabot security updates require a published GHSA advisory, so they cannot be triggered by an upstream release self-declaring itself a "security" fix. Routine Go dependency bumps are now done manually when we actually need them. - **Both gomod blocks:** raise the cooldown from 4 to 14 days, giving any release a longer window to be flagged before it is auto-considered (the `v3-3-test` branch still does grouped minor/patch bumps). This only changes the automation posture for Go modules — no dependency versions change, and security fixes still flow automatically. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.8) Generated-by: Claude Code (Opus 4.8) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
