[high] API contract violation

The main go.mod bumps testcontainers-go/modules/registry from v0.34.0 to v0.42.0, while the base testcontainers-go package remains pinned at v0.34.1-0.20241204123437-72be13940122. This creates a version mismatch: modules/registry v0.42.0 may depend on APIs from testcontainers-go v0.42.0, but the base package is still at v0.34.x. The benchmark code imports both and uses potentially deprecated APIs like WithConfigModifier and WithHostConfigModifier.

Suggested fix: Either bump the base testcontainers-go package to v0.42.0 (and update deprecated API usage), or keep modules/registry at v0.34.0 to match the pinned base version. Verify the fix from testcontainers/testcontainers-go#2899 is included in v0.42.0 before unpinning.

[high] API contract violation

The acceptance module bumps testcontainers-go from v0.34.0 to v0.42.0 (8 minor versions). The acceptance module directly uses GenericContainer, ContainerRequest, GenericContainerRequest, and ContainerFile which were deprecated or changed between v0.34 and v0.42.

Suggested fix: Verify that testcontainers-go v0.42.0 still supports GenericContainer, ContainerRequest, GenericContainerRequest, and ContainerFile APIs. If any are removed, update the acceptance test code accordingly.

[medium] API contract violation

sigs.k8s.io/kind is bumped from v0.26.0 to v0.32.0 (6 minor versions). The acceptance module uses v1alpha4 config types, cluster Provider methods, and log interfaces extensively.

Suggested fix: Verify that the kind v0.32.0 API is backward-compatible for all used types and functions.

[high] API contract violation

The PR updates testcontainers-go from v0.34.0 to v0.43.0 in acceptance/go.mod. The acceptance code uses testcontainers.GenericContainer() and testcontainers.GenericContainerRequest{} in at least three files (acceptance/wiremock/wiremock.go:220, acceptance/registry/registry.go:112, acceptance/git/git.go:183). These APIs were deprecated around v0.35/v0.36 in favor of testcontainers.Run(). A 9 minor-version jump in a v0.x module can include breaking changes per Go semver conventions. If GenericContainer has been removed in v0.43.0, the acceptance tests will fail to compile.

Suggested fix: Verify that the acceptance tests compile and pass with testcontainers-go v0.43.0. If GenericContainer has been removed, migrate to testcontainers.Run() and update container setup patterns. Alternatively, pin to a version that still supports GenericContainer.

[medium] API contract violation

The root go.mod has testcontainers-go core at pseudo-version v0.34.1-0.20241204123437-72be13940122 with a comment referencing an unreleased fix from PR #2899. The PR updates testcontainers-go/modules/registry from v0.34.0 to v0.43.0 without updating the core. This creates a version mismatch between core (v0.34.x) and modules/registry (v0.43.0) that may cause incompatibilities.

Suggested fix: Confirm that testcontainers-go PR #2899 fix is included in v0.43.0. If so, update core testcontainers-go to v0.43.0 as well. If not, keep both at v0.34.0.

[low] Version skew

k8s.io/kubernetes is being updated alongside k8s.io/api, k8s.io/apimachinery, and k8s.io/client-go. The current tools/kubectl/go.mod shows version skew between k8s.io packages. Ensure all k8s.io/* indirect deps are updated to consistent versions after the bump.

Suggested fix: Run go mod tidy after updating k8s.io/kubernetes to ensure all k8s.io sub-packages are at consistent versions.

[info] Dependency verification

sigs.k8s.io/controller-runtime is being updated from v0.19.0 to v0.24.1 as an indirect dependency. This is a significant jump but since it is only indirect, API breakage risk is limited to transitive consumers.

[info] stale comment

The comment on testcontainers-go says 'using unreleased version that contains the fix'. If bumped to v0.43.0 (a released version), the comment becomes stale.

[medium] go version inconsistency

The go directive is bumped from 1.25.8 to 1.26.0 while all other modules remain at 1.25.8, creating a split Go version requirement within the same repository.

Suggested fix: Verify that CI build environments support Go 1.26.0. If the other modules also need Go 1.26 features, consider aligning all go.mod files to 1.26.0.

[low] version-consistency

The main testcontainers-go module remains pinned to a pseudo-version (v0.34.1-0.20241204123437-72be13940122) with a comment referencing an unreleased fix from PR #2899, while the modules/registry submodule is bumped from v0.34.0 to v0.43.0. Given the large version gap, the fix from PR #2899 is almost certainly included in v0.43.0. Consider bumping the main module to v0.43.0 as well and removing the explanatory comment.

Suggested fix: Bump github.com/testcontainers/testcontainers-go to v0.43.0 and remove the pseudo-version pin comment.

[critical] invalid go.mod syntax

The replace directive for go-containerregistry is changed from a valid pseudo-version (v0.20.7-0.20251103083939-3459088e4bae) to a bare commit hash (b75247998fd1). Go modules require version strings in replace directives to be valid semver or pseudo-versions. A bare commit hash is not valid go.mod syntax and will cause go mod tidy, go build, and all other Go toolchain commands to fail with a parse error.

Suggested fix: Replace b75247998fd1 with a proper pseudo-version generated from that commit. Run go mod tidy after pointing the replace to the correct fork commit, or use GOFLAGS=-mod=mod go get github.com/conforma/go-containerregistry@b75247998fd1 to let Go generate the correct pseudo-version string automatically.

[critical] invalid go.mod syntax

Same issue as in the root go.mod: the replace directive for go-containerregistry is changed from a valid pseudo-version (v0.20.7-0.20250703195040-6f40a3734728) to a bare commit hash (b75247998fd1). This is invalid go.mod syntax and will break all Go toolchain operations for the acceptance module.

Suggested fix: Replace b75247998fd1 with a proper pseudo-version. Run go mod tidy in the acceptance/ directory after setting the replace to the correct fork commit.

[high] version mismatch

The testcontainers-go/modules/registry sub-module is updated from v0.34.0 to v0.43.0, but the base testcontainers-go module remains pinned at a pre-release pseudo-version v0.34.1-0.20241204123437-72be13940122. The modules/registry v0.43.0 sub-module will require testcontainers-go v0.43.0 as a dependency. This version mismatch between a v0.43.0 sub-module and a v0.34.x base module will likely result in build failures or incompatible API usage at runtime.

Suggested fix: Either update the base testcontainers-go to v0.43.0 (verifying that the fix from PR #2899 is included), or keep modules/registry at v0.34.0 to match the pinned base version.

[critical] invalid go.mod syntax

The replace directive uses a bare commit hash 8acb20af1601 instead of a valid Go module pseudo-version. Go module versions in go.mod must follow semver format. A bare 12-character commit hash is not valid go.mod syntax and will cause all go commands to fail. The previous version v0.21.8-0.20260626175242-ae5f0ae7a0b0 was correctly formatted. This same issue appears in acceptance/go.mod.

Suggested fix: Replace 8acb20af1601 with a proper pseudo-version string. Run go get github.com/conforma/go-containerregistry@8acb20af1601 to resolve the commit hash to a proper pseudo-version.

[critical] invalid go.mod syntax

The dependency github.com/Microsoft/go-winio 75610162e7da uses a bare commit hash instead of a valid Go module version string. The previous version was v0.6.3-0.20251027160822-ad3df93bed29. This appears in acceptance/go.mod and tools/go.mod as well.

Suggested fix: Replace 75610162e7da with a proper pseudo-version. Run go get github.com/Microsoft/go-winio@75610162e7da to resolve the correct pseudo-version format.

[critical] invalid go.mod syntax

The dependency github.com/planetscale/vtprotobuf ba97887b0a25 uses a bare commit hash instead of a valid Go module version string. The previous version was v0.6.1-0.20240319094008-0393e58bdf10. This appears in both go.mod and tools/go.mod.

Suggested fix: Replace ba97887b0a25 with a proper pseudo-version. Run go get github.com/planetscale/vtprotobuf@ba97887b0a25 to resolve the correct pseudo-version format.

[medium] version inconsistency across modules

The root go.mod keeps testcontainers-go pinned at the unreleased fork version v0.34.1-0.20241204123437-72be13940122 while acceptance/go.mod updates to v0.43.0 and modules/registry in the root go.mod also updates to v0.43.0. The fix from PR #2899 has very likely been included in v0.43.0, making the pin stale and potentially causing runtime incompatibilities.

Suggested fix: Update testcontainers-go in the root go.mod from the pinned pre-release to v0.43.0 and remove or update the stale comment.