fix(deps): update github.com/openshift-online/rh-trex-ai digest to d7f66e5 - autoclosed

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
github.com/openshift-online/rh-trex-ai	require	digest	5798cb6 → d7f66e5

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 07:59 AM, only on Monday (* 0-7 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: components/api-server/go.sum

Command failed: go get -t ./...
go: downloading github.com/golang/glog v1.2.5
go: downloading github.com/openshift-online/rh-trex-ai v0.0.32-0.20260914193017-d7f66e5f0673
go: downloading go.opentelemetry.io/otel/trace v1.44.0
go: downloading go.opentelemetry.io/otel v1.44.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading google.golang.org/grpc v1.82.1
go: downloading google.golang.org/protobuf v1.36.11
go: downloading github.com/spf13/cobra v0.0.5
go: downloading github.com/golang-jwt/jwt/v4 v4.5.2
go: downloading github.com/gorilla/mux v1.7.3
go: downloading github.com/go-gormigrate/gormigrate/v2 v2.1.6
go: downloading gorm.io/gorm v1.31.1
go: downloading github.com/onsi/gomega v1.27.1
go: downloading gopkg.in/resty.v1 v1.12.0
go: downloading github.com/prometheus/client_golang v1.16.0
go: downloading github.com/segmentio/ksuid v1.0.2
go: downloading github.com/uptrace/opentelemetry-go-extra/otelgorm v0.3.2
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
go: downloading go.opentelemetry.io/otel/metric v1.44.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.44.0
go: downloading go.opentelemetry.io/otel/sdk v1.44.0
go: downloading github.com/prometheus/client_model v0.3.0
go: downloading github.com/spf13/pflag v1.0.5
go: downloading github.com/yaacov/tree-search-language v0.0.0-20190923184055-1c2dad2e354b
go: downloading golang.org/x/net v0.57.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a
go: downloading github.com/inconshreveable/mousetrap v1.0.0
go: downloading github.com/jinzhu/now v1.1.5
go: downloading github.com/google/go-cmp v0.7.0
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/prometheus/common v0.42.0
go: downloading github.com/prometheus/procfs v0.10.1
go: downloading golang.org/x/sys v0.47.0
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading github.com/go-logr/logr v1.4.3
go: downloading github.com/uptrace/opentelemetry-go-extra/otelsql v0.3.2
go: downloading go.opentelemetry.io/proto/otlp v1.11.0
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/antlr/antlr4 v0.0.0-20190518164840-edae2a1c9b4b
go: downloading github.com/Masterminds/squirrel v1.1.0
go: downloading github.com/jinzhu/inflection v1.0.0
go: downloading golang.org/x/text v0.40.0
go: downloading github.com/matttproud/golang_protobuf_extensions v1.0.4
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading github.com/cenkalti/backoff/v5 v5.0.3
go: downloading github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0
go: downloading github.com/lann/builder v0.0.0-20180802200727-47ae307949d0
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a
go: downloading github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0
go: downloading github.com/openshift-online/rh-trex-ai v0.0.31
go: github.com/openshift-online/hypershell/components/api-server/cmd/hypershell imports
	github.com/openshift-online/rh-trex-ai/pkg/cmd: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/cmd
go: github.com/openshift-online/hypershell/components/api-server/cmd/hypershell imports
	github.com/openshift-online/rh-trex-ai/plugins/events: cannot find module providing package github.com/openshift-online/rh-trex-ai/plugins/events
go: github.com/openshift-online/hypershell/components/api-server/cmd/hypershell imports
	github.com/openshift-online/rh-trex-ai/plugins/generic: cannot find module providing package github.com/openshift-online/rh-trex-ai/plugins/generic
go: github.com/openshift-online/hypershell/components/api-server/cmd/hypershell/environments imports
	github.com/openshift-online/rh-trex-ai/pkg/config: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/config
go: github.com/openshift-online/hypershell/components/api-server/cmd/hypershell/environments imports
	github.com/openshift-online/rh-trex-ai/pkg/db/db_session: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/db/db_session
go: github.com/openshift-online/hypershell/components/api-server/cmd/hypershell/environments imports
	github.com/openshift-online/rh-trex-ai/pkg/db/mocks: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/db/mocks
go: github.com/openshift-online/hypershell/components/api-server/cmd/hypershell/environments imports
	github.com/openshift-online/rh-trex-ai/pkg/environments: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/environments
go: github.com/openshift-online/hypershell/components/api-server/cmd/hypershell/environments imports
	github.com/openshift-online/rh-trex-ai/pkg/trex: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/trex
go: github.com/openshift-online/hypershell/components/api-server/pkg/api imports
	github.com/openshift-online/rh-trex-ai/pkg/api: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/api
go: github.com/openshift-online/hypershell/components/api-server/pkg/rbac imports
	github.com/openshift-online/rh-trex-ai/pkg/auth: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/auth
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/api/presenters: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/api/presenters
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/controllers: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/controllers
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/db: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/db
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/errors: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/errors
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/handlers: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/handlers
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/logger: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/logger
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/registry: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/registry
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/server: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/server
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/server/grpcutil: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/server/grpcutil
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/services: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/services
go: github.com/openshift-online/hypershell/components/api-server/plugins/gatewayNetworks imports
	github.com/openshift-online/rh-trex-ai/pkg/util: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/util
go: github.com/openshift-online/hypershell/components/api-server/plugins/gateways imports
	github.com/openshift-online/rh-trex-ai/pkg/dao: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/dao
go: github.com/openshift-online/hypershell/components/api-server/test imports
	github.com/openshift-online/rh-trex-ai/pkg/testutil: cannot find module providing package github.com/openshift-online/rh-trex-ai/pkg/testutil

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: fb9205a3-fc20-4fc0-895f-1c5b454fa4d0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[jsell-rh]

Amber review

Status: Complete

Verdict

This is a bot-generated digest bump of github.com/openshift-online/rh-trex-ai (5798cb6 → d5888ed) affecting only components/api-server/go.mod and go.sum. The bump is mechanically sound, but this specific digest appears to carry framework authentication-behavior changes and a large new transitive dependency surface, so it warrants maintainer attention before merging as "routine."

Findings

[Major] This digest appears to change API server authentication behavior — Security / Dependency (go.mod L11) — Confidence: Medium
The target digest d5888ed is the same one being adopted deliberately elsewhere to obtain configurable JWT issuer/audience validation and fail-closed signed-token verification from the framework. Landing that framework behavior change through a routine, auto-generated dependency bump — without the corresponding HyperShell-side auth configuration — could silently alter how the API server accepts or rejects tokens. Before merging, confirm the API server still authenticates as expected against the new framework version (integration/e2e auth tests), and coordinate with the auth-enforcement work (see Cross-PR coordination).

[Minor] Large TUI/CLI transitive dependency surface added to a server module — Supply chain (go.mod L48) — Confidence: Medium
The bump pulls in a substantial set of terminal-UI indirect dependencies (charmbracelet/bubbletea, charmbracelet/lipgloss, muesli/termenv, mattn/go-runewidth, atotto/clipboard, xo/terminfo, etc.) into the API server module. These are transitive from the framework and therefore not directly controllable here, but they are unusual for a headless server component and materially expand the transitive attack surface. Worth confirming with the framework maintainers that these belong in the runtime dependency graph rather than a build/tooling-only path.

[Minor] Verify module consistency in CI — Build (go.sum) — Confidence: High
As an auto-generated bot PR, go build ./..., go vet ./..., and go mod verify cannot be validated offline during review. Ensure CI exercises these against the new digest before merge.

Cross-PR coordination

Another open pull request adopts this exact same rh-trex-ai digest (d5888ed) on purpose, to enable configurable JWT issuer/audience validation and fail-closed token verification, and it pairs the bump with the required HyperShell-side changes (deploy kustomizations, dependency-age-allowlist.json, and the OIDC integration spec). This PR performs the identical go.mod/go.sum bump alone.

Maintainers must decide the merge order and ownership of the version bump:

• If this routine bot bump merges first, the framework's fail-closed token-verification behavior lands in the API server without the accompanying audience-enforcement configuration, which could change authentication behavior in deployed environments until the auth PR follows.
• If the auth PR merges first, this PR becomes a redundant no-op bump and should be closed/rebased.

This is a duplicate change to the same pinned dependency where one side owns security-relevant behavior; please coordinate rather than merging both independently.

Findings Summary (ordered by severity, highest first)

1. [Major] Digest carries framework auth-behavior change landing via a routine bump - Security / Dependency (go.mod L11)
2. [Minor] Large TUI/CLI transitive dependency surface added to server module - Supply chain (go.mod L48)
3. [Minor] Verify go build/go mod verify consistency in CI - Build (go.sum)

Convention Checklist

Convention	Result
Conventional commit message	Pass
OpenAPI client not manually edited	Pass (no client changes)
Dependency / supply-chain surface reviewed	Note
Module (go.mod/go.sum) consistency	Verify in CI

[jsell-rh]

Verdict

This is a bot-generated digest bump of github.com/openshift-online/rh-trex-ai (5798cb6 → d5888ed) affecting only components/api-server/go.mod and go.sum. The bump is mechanically sound, but this specific digest appears to carry framework authentication-behavior changes and a large new transitive dependency surface, so it warrants maintainer attention before merging as "routine."

Findings

[Major] This digest appears to change API server authentication behavior — Security / Dependency (go.mod L11) — Confidence: Medium
The target digest d5888ed is the same one being adopted deliberately elsewhere to obtain configurable JWT issuer/audience validation and fail-closed signed-token verification from the framework. Landing that framework behavior change through a routine, auto-generated dependency bump — without the corresponding HyperShell-side auth configuration — could silently alter how the API server accepts or rejects tokens. Before merging, confirm the API server still authenticates as expected against the new framework version (integration/e2e auth tests), and coordinate with the auth-enforcement work (see Cross-PR coordination).

[Minor] Large TUI/CLI transitive dependency surface added to a server module — Supply chain (go.mod L48) — Confidence: Medium
The bump pulls in a substantial set of terminal-UI indirect dependencies (charmbracelet/bubbletea, charmbracelet/lipgloss, muesli/termenv, mattn/go-runewidth, atotto/clipboard, xo/terminfo, etc.) into the API server module. These are transitive from the framework and therefore not directly controllable here, but they are unusual for a headless server component and materially expand the transitive attack surface. Worth confirming with the framework maintainers that these belong in the runtime dependency graph rather than a build/tooling-only path.

[Minor] Verify module consistency in CI — Build (go.sum) — Confidence: High
As an auto-generated bot PR, go build ./..., go vet ./..., and go mod verify cannot be validated offline during review. Ensure CI exercises these against the new digest before merge.

Cross-PR coordination

Another open pull request adopts this exact same rh-trex-ai digest (d5888ed) on purpose, to enable configurable JWT issuer/audience validation and fail-closed token verification, and it pairs the bump with the required HyperShell-side changes (deploy kustomizations, dependency-age-allowlist.json, and the OIDC integration spec). This PR performs the identical go.mod/go.sum bump alone.

Maintainers must decide the merge order and ownership of the version bump:

• If this routine bot bump merges first, the framework's fail-closed token-verification behavior lands in the API server without the accompanying audience-enforcement configuration, which could change authentication behavior in deployed environments until the auth PR follows.
• If the auth PR merges first, this PR becomes a redundant no-op bump and should be closed/rebased.

This is a duplicate change to the same pinned dependency where one side owns security-relevant behavior; please coordinate rather than merging both independently.

Findings Summary (ordered by severity, highest first)

1. [Major] Digest carries framework auth-behavior change landing via a routine bump - Security / Dependency (go.mod L11)
2. [Minor] Large TUI/CLI transitive dependency surface added to server module - Supply chain (go.mod L48)
3. [Minor] Verify go build/go mod verify consistency in CI - Build (go.sum)

Convention Checklist

Convention	Result
Conventional commit message	Pass
OpenAPI client not manually edited	Pass (no client changes)
Dependency / supply-chain surface reviewed	Note
Module (go.mod/go.sum) consistency	Verify in CI

[jsell-rh]

[Major] Auth-behavior change riding in on this digest. This d5888ed digest appears to include the framework's configurable JWT issuer/audience validation and fail-closed signed-token verification. Adopting it via a routine bot bump can change how the API server accepts/rejects tokens without the paired HyperShell-side auth configuration. Please run the auth integration/e2e suite against this digest and coordinate merge order with the auth-enforcement work before merging (see the Cross-PR coordination section).

[jsell-rh]

[Minor] Terminal-UI transitive deps in a headless server module. This bump introduces a large set of TUI/CLI indirect dependencies (charmbracelet/bubbletea, lipgloss, muesli/termenv, mattn/go-runewidth, atotto/clipboard, xo/terminfo, ...). They're transitive from the framework, but they meaningfully expand the runtime supply-chain surface for a server component. Worth confirming with the framework maintainers that these belong in the runtime graph rather than a tooling-only path.

[jsell-rh]

Amber review

Status: Complete

View the submitted review.

[jsell-rh]

Verdict

This is an automated Konflux/Renovate digest bump of github.com/openshift-online/rh-trex-ai (5798cb6 -> d5888ed) touching only components/api-server/go.mod and go.sum. The change is mechanically sound and conventionally committed; the one thing worth a human's eyes is that the new digest drags a full terminal-UI dependency stack into a REST/gRPC API server as transitive // indirect deps.

Findings

[Minor] Large TUI dependency stack pulled transitively into the API server - Dependency Surface (go.mod:42-56, go.sum)
The digest bump adds the Charmbracelet Bubble Tea ecosystem (bubbletea, bubbles, lipgloss, termenv, muesli/ansi, muesli/cancelreader, atotto/clipboard, xo/terminfo, rivo/uniseg, several charmbracelet/x/*, and golang.org/x/exp) as new // indirect requirements. These are interactive-terminal libraries with no obvious role in a server-side REST/gRPC + PostgreSQL service, so this materially widens the transitive dependency and attack surface. The addition originates upstream in rh-trex-ai, so it is not directly controllable here, but a maintainer should confirm the upstream bump was intended to bring these in (rather than a leaked main/CLI dependency) before merging. Confidence: Medium.

Verification note (Blocker to my own confidence, not to the PR): the sandbox has no Go toolchain, so I could not run go build ./..., go vet ./..., or go mod verify to confirm the module graph is tidy and reproducible. Please rely on CI to gate compilation and checksum verification. Confidence: High that these checks are required; unverified locally.

Cross-PR coordination

No material cross-PR coordination issue requires maintainer action.

Findings Summary (ordered by severity, highest first)

1. [Minor] Terminal-UI dependency stack added as new indirect deps in a server component; confirm the upstream digest intended this - Dependency Surface (go.mod:42-56)

Convention Checklist

Convention	Result
Conventional commit message (fix(deps): ...)	Pass
Dependency version consistent across modules (only api-server imports rh-trex-ai)	Pass
go.sum hashes present for updated/added modules	Pass
No em dashes in changed files	Pass
Build / go mod verify locally validated	Not verified (no Go toolchain; defer to CI)

[jsell-rh]

This digest bump introduces the Charmbracelet terminal-UI stack (bubbletea, bubbles, lipgloss, termenv, atotto/clipboard, etc.) as new // indirect dependencies of the API server. These are interactive-TTY libraries with no evident role in a REST/gRPC + PostgreSQL service, so they meaningfully expand the transitive/attack surface. They come in via the upstream rh-trex-ai bump rather than anything in this repo - please confirm upstream intended to expose them before merging.

[amber-review-bot]

Amber review

Status: Complete

View the submitted review.

[amber-review-bot]

Verdict

This Konflux/Renovate digest bump writes a bare commit hash (d7f66e5f0673) into the rh-trex-ai require directive instead of a valid Go pseudo-version, and leaves go.sum untouched, so components/api-server/go.mod will not parse and the api-server build/test will fail. This is the same defect flagged on the prior head; it must be regenerated (or rebased) before it can merge.

Findings

[Blocker] Malformed require directive - bare commit hash, not a Go (pseudo-)version - Build / Dependency Integrity (components/api-server/go.mod L13) - Confidence: High
The line now reads:

github.com/openshift-online/rh-trex-ai d7f66e5f0673

d7f66e5f0673 is a bare 12-character commit hash. A require directive must carry a semantic version or a pseudo-version of the form v0.0.0-<yyyymmddhhmmss>-<12-char-hash> (compare the prior v0.0.32-0.20260819203335-5798cb607fcb). As written, go mod/go build/go test cannot parse this file, so the api-server component will not build. Regenerate with go get github.com/openshift-online/rh-trex-ai@d7f66e5 && go mod tidy so the correct pseudo-version is substituted. This is the identical defect previously reported (only the hash changed); see the existing discussion in #34 (comment).

[Blocker] go.sum not updated for the new digest - Build / Dependency Integrity (components/api-server/go.sum) - Confidence: High
go.sum still contains only the previous entries and has no diff in this PR:

github.com/openshift-online/rh-trex-ai v0.0.32-0.20260819203335-5798cb607fcb h1:...
github.com/openshift-online/rh-trex-ai v0.0.32-0.20260819203335-5798cb607fcb/go.mod h1:...

There is no h1://go.mod checksum for the new digest and the stale old-version entry remains. Even after L13 is corrected, dependency verification/download will fail on a missing/mismatched checksum. Regenerate both files together with go mod tidy so go.mod and go.sum stay consistent.

[Major] dependency-age-allowlist.json not updated for the new digest - Supply chain / Policy (dependency-age-allowlist.json L5) - Confidence: Medium
The allowlist still pins rh-trex-ai at v0.0.32-0.20260819203335-5798cb607fcb with a reason tied to the old commit. Bumping the module to d7f66e5 without a matching allowlist entry (version + reason + compensating verification) will either trip the dependency-age policy check or leave a stale justification that no longer describes the code being pulled in. Update the allowlist entry alongside the version bump.

[Minor] New digest contents unverifiable at this head - Dependency Surface (components/api-server/go.mod L13) - Confidence: Medium
Because the module reference is unresolvable (bare hash, no go.sum), the transitive graph and framework-behavior changes carried by d7f66e5 cannot be verified offline. Earlier reviews of the d5888ed digest flagged framework authentication-behavior changes and a large terminal-UI transitive surface; re-verify both against d7f66e5 once the module file is valid (see #34 (comment) and #34 (comment)). Ensure CI exercises go build ./..., go vet ./..., and go mod verify; these cannot be validated offline during review.

Cross-PR coordination

Another open pull request, #182, changes the same github.com/openshift-online/rh-trex-ai line in components/api-server/go.mod/go.sum to a different digest (v0.0.32-0.20260821210346-d5888edfb8cd) and owns the security-relevant behavior of that bump: it deliberately adopts configurable JWT issuer/audience validation plus fail-closed signed-token verification, and pairs the version bump with the required HyperShell-side changes (deploy kustomizations, the dependency-age-allowlist.json entry, and the OIDC integration spec). This PR moves the same pinned dependency to a different, later digest (d7f66e5) with none of that paired configuration and no allowlist update.

Maintainers must decide merge order and ownership of this version bump:

• If this bot bump merges first, the framework's fail-closed/audience-enforcement behavior can land in the API server without the paired deployment configuration and allowlist justification, and #182 must then rebase onto d7f66e5 and re-verify that the audience-enforcement behavior is preserved at the newer digest.
• If #182 merges first, this PR becomes a further bump past d5888ed that requires re-verifying the security-relevant behavior still holds and updating the allowlist reason accordingly.

This is a competing bump to the same pinned, security-relevant dependency where change order matters; please coordinate rather than merging both independently.

Previous concerns

• Bare commit hash in require (was b4a9b6725ad2, review pullrequestreview-5193954451, inline r4002244372): Still present - components/api-server/go.mod L13 now reads github.com/openshift-online/rh-trex-ai d7f66e5f0673, still a bare hash.
• go.sum not updated for the new digest (pullrequestreview-5193954451): Still present - components/api-server/go.sum has no diff in this PR and retains only the 5798cb607fcb entries.
• Digest may carry framework auth-behavior change (inline r3891877248): Cannot verify - target digest changed from d5888ed to d7f66e5; with an unresolvable module reference and no go.sum, the contents cannot be confirmed offline. Tracked under Cross-PR coordination.
• Large terminal-UI transitive dependency surface (inline r3891877251, r3946740147): Cannot verify - go.sum was not regenerated, so the transitive graph for d7f66e5 is not reflected in this diff.

Findings Summary (ordered by severity, highest first)

1. [Blocker] rh-trex-ai require line is a bare commit hash, not a valid Go (pseudo-)version - breaks module parsing/build - Build / Dependency Integrity (go.mod L13)
2. [Blocker] go.sum lacks checksums for the new digest and retains stale old-version entries - dependency verification fails - Build / Dependency Integrity (go.sum)
3. [Major] dependency-age-allowlist.json still pins the old digest - policy/justification drift - Supply chain / Policy (allowlist L5)
4. [Minor] New digest contents (auth behavior, transitive surface) unverifiable until the module file is valid - Dependency Surface (go.mod L13)

Convention Checklist

Convention	Result
Valid Go module version in require	Fail
go.mod and go.sum consistent	Fail
Dependency-age allowlist consistent with pinned version	Fail
Conventional commit message	Pass
OpenAPI client not manually edited	Pass (no client changes)
Build / go mod verify validated	Not verified (no Go toolchain; defer to CI)