Bump pflag to 1.0.8 #2303

tomasaschan · 2025-08-31T20:06:48Z

In pflag, we recently made a breaking change in naming to be more inclusive. This change, while doing nothing to address the same uninclusive naming in cobra itself, adjusts to those changes to ensure automatic bumps (if you do them) can continue uninterrupted.

CLAassistant · 2025-08-31T20:06:53Z

All committers have signed the CLA.

nadeemc · 2025-08-31T22:44:27Z

Until this is merged, those running into issues can use this go.mod workaround:

// Needed until PR fix is merged:
// https://github.com/spf13/cobra/pull/2303
replace github.com/spf13/cobra => github.com/tomasaschan/cobra v1.9.2-0.20250831200618-527c4d0e1829

marckhouzam · 2025-08-31T23:08:31Z

@nadeemc curious why someone would need a workaround since I assume cobra will only break if pointing to the new pflag? Maybe for projects that directly include pflag as well as cobra?

marckhouzam

I like that such names are being updated.
Thanks for being proactive and opening this PR.

Although I would like to make a similar change for cobra, our policy is to be completely backwards compatible, so for the moment at least, I don’t think we should go beyond this current PR

nadeemc · 2025-08-31T23:29:00Z

@nadeemc curious why someone would need a workaround since I assume cobra will only break if pointing to the new pflag? Maybe for projects that directly include pflag as well as cobra?

Hi @marckhouzam!

Thanks for getting this merged!

For me, and others (spf13/pflag#445), running a go mod update and tidy, even though the spf13/cobra version remained at v1.9.1, did break builds because of the pflag bump.

Glad it was a very temporary workaround ;)

marckhouzam · 2025-08-31T23:32:02Z

Is this merge good enough or do we need a cobra release for this? I still don’t quite get when things break…

nadeemc · 2025-08-31T23:38:15Z

@marckhouzam It will need a release to bump spf13/cobra to v1.9.2 or v1.10.0. Otherwise, anyone using go get -u ./... within a directory with go.mod will see something like this:

require (
	github.com/spf13/cobra v1.9.1
)

require (
-	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/spf13/pflag v1.0.8 // indirect
)

Which will break the build without spf13/cobra also having a version bump and being picked up by the go get -u command.

tomasaschan · 2025-09-01T08:19:23Z

Fwiw I tagged v1.0.9 of pflag to avoid breaking users of Cobra until this is in a tagged release, so it is less urgent now than it was.

But we would still like to remove these old names eventually (likely before 2.0), and tagging a Cobra release that includes this patch (and, potentially but not necessarily, further bumps of pflag) will be a prerequisite for us to do that without causing the same kind of breakage across the ecosystem again.

jpmcb · 2025-09-01T13:13:29Z

curious why someone would need a workaround since I assume cobra will only break if pointing to the new pflag? Maybe for projects that directly include pflag as well as cobra?

@marckhouzam - yes, this is exactly the scenario that would break downstream consumers of both pflag and cobra: anyone who upgrades to pflag v1.0.8 (via something like go get -u ./...) breaks their cobra builds. This is mostly a design choice by the original Go authors: there's not really the concept of shadow dependencies or multi-versioned dependencies unless you explicitly put them in something like github.com/user/package/v2 where the code path itself is the version.

The blast radius of this was quite large actually: I got pinged by some people that kubernetes/kubernetes builds were failing on their main branch which also ensures that AWS, Google cloud, Nvidia, etc. etc. are not able to build their distros on the tip of their CI/CDs:

https://prow.k8s.io/view/gs/kubernetes-ci-logs/logs/ci-kubernetes-unit-dependencies/1962249657098702848

In the past, cobra has probably been overly cautious about taking any kind of breaking change since there are just so many projects that use it: the APIs are stable and assumed to be non-breaking. Doing anything that breaks that semver contract erodes alot of trust in the library (and us as maintainers).

tomasaschan · 2025-09-01T16:56:43Z

The blast radius of this was quite large actually

As you can probably tell from my original PR message, I had no idea the blast radius of that change in pflag would be this massive. Basically, I (incorrectly) assumed that Cobra users wouldn't notice unless they explicitly tried to upgrade pflag, but of course I realized Cobra itself would need a few small changes to be able to keep rolling forward - hence this PR.

The immediate issues have been resolved now with v1.0.9 which restores the removed names, so anything that got bitten by some autobump thingy should also be fixed by the same autobump thingy without further action required.

That said, it also seems that anything important that broke because of the pflag change used pflag indirectly through Cobra. If you'd like, I'd be happy to include (but not author... PRs welcome!) a set of integration tests on the pflag side to ensure that any change merged there does not have this type of effect downstream.

This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/spf13/cobra](https://github.com/spf13/cobra) | `v1.9.1` -> `v1.10.1` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fspf13%2fcobra/v1.10.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fspf13%2fcobra/v1.9.1/v1.10.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>spf13/cobra (github.com/spf13/cobra)</summary> ### [`v1.10.1`](https://github.com/spf13/cobra/releases/tag/v1.10.1) [Compare Source](spf13/cobra@v1.10.0...v1.10.1) ##### 🐛 Fix - chore: upgrade pflags v1.0.9 by [@jpmcb](https://github.com/jpmcb) in [#2305](spf13/cobra#2305) v1.0.9 of pflags brought back `ParseErrorsWhitelist` and marked it as deprecated **Full Changelog**: <spf13/cobra@v1.10.0...v1.10.1> ### [`v1.10.0`](https://github.com/spf13/cobra/releases/tag/v1.10.0) [Compare Source](spf13/cobra@v1.9.1...v1.10.0) #### What's Changed ##### 🚨 Attention! - Bump pflag to 1.0.8 by [@tomasaschan](https://github.com/tomasaschan) in [#2303](spf13/cobra#2303) This version of `pflag` carried a breaking change: it renamed `ParseErrorsWhitelist` to `ParseErrorsAllowlist` which can break builds if both `pflag` and `cobra` are dependencies in your project. - If you use both `pflag and `cobra`, upgrade `pflag`to 1.0.8 and`cobra`to`1.10.0\` - ***or*** use the newer, fixed version of `pflag` v1.0.9 which keeps the deprecated `ParseErrorsWhitelist` More details can be found here: [#2303 (comment)](spf13/cobra#2303 (comment)) ##### ✨ Features - Flow context to command in SetHelpFunc by [@Frassle](https://github.com/Frassle) in [#2241](spf13/cobra#2241) - The default ShellCompDirective can be customized for a command and its subcommands by [@albers](https://github.com/albers) in [#2238](spf13/cobra#2238) ##### 🐛 Fix - Upgrade golangci-lint to v2, address findings by [@scop](https://github.com/scop) in [#2279](spf13/cobra#2279) ##### 🪠 Testing - Test with Go 1.24 by [@harryzcy](https://github.com/harryzcy) in [#2236](spf13/cobra#2236) - chore: Rm GitHub Action PR size labeler by [@jpmcb](https://github.com/jpmcb) in [#2256](spf13/cobra#2256) ##### 📝 Docs - Remove traling curlybrace by [@yedayak](https://github.com/yedayak) in [#2237](spf13/cobra#2237) - Update command.go by [@styee](https://github.com/styee) in [#2248](spf13/cobra#2248) - feat: Add security policy by [@jpmcb](https://github.com/jpmcb) in [#2253](spf13/cobra#2253) - Update Readme (Warp) by [@ericdachen](https://github.com/ericdachen) in [#2267](spf13/cobra#2267) - Add Periscope to the list of projects using Cobra by [@anishathalye](https://github.com/anishathalye) in [#2299](spf13/cobra#2299) #### New Contributors - [@harryzcy](https://github.com/harryzcy) made their first contribution in [#2236](spf13/cobra#2236) - [@yedayak](https://github.com/yedayak) made their first contribution in [#2237](spf13/cobra#2237) - [@Frassle](https://github.com/Frassle) made their first contribution in [#2241](spf13/cobra#2241) - [@styee](https://github.com/styee) made their first contribution in [#2248](spf13/cobra#2248) - [@ericdachen](https://github.com/ericdachen) made their first contribution in [#2267](spf13/cobra#2267) - [@albers](https://github.com/albers) made their first contribution in [#2238](spf13/cobra#2238) - [@anishathalye](https://github.com/anishathalye) made their first contribution in [#2299](spf13/cobra#2299) - [@tomasaschan](https://github.com/tomasaschan) made their first contribution in [#2303](spf13/cobra#2303) **Full Changelog**: <spf13/cobra@v1.9.1...v1.9.2> </details> --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).    - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/930): Update module github.com/spf13/cobra to v1.10.1  Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/930 Reviewed-by: earl-warren <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

Bump pflag to 1.0.8

527c4d0

In pflag, we recently made a breaking change in naming to be more inclusive. This change, while doing nothing to address the same uninclusive naming in cobra itself, adjusts to those changes to ensure automatic bumps (if you do them) can continue uninterrupted.

nadeemc mentioned this pull request Aug 31, 2025

Tag 1.0.8 does not follow semver best practices spf13/pflag#445

Closed

marckhouzam approved these changes Aug 31, 2025

View reviewed changes

marckhouzam merged commit 51d6751 into spf13:main Aug 31, 2025
21 checks passed

marckhouzam added this to the 1.10.0 milestone Aug 31, 2025

nightah mentioned this pull request Sep 1, 2025

undefined: flag.ParseErrorsWhitelist - pflags breaking changes #2304

Closed

jandubois mentioned this pull request Sep 1, 2025

build(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.9 lima-vm/lima#3940

Merged

marc1404 mentioned this pull request Sep 1, 2025

Update module github.com/spf13/pflag to v1.0.8 gardener/gardener#12850

Closed

1 task

stefanprodan mentioned this pull request Sep 1, 2025

Bump github.com/spf13/pflag from 1.0.7 to 1.0.8 in the go-deps group fluxcd/kustomize-controller#1503

Closed

tomasaschan deleted the bump-pflag branch September 1, 2025 08:44

jpmcb mentioned this pull request Sep 1, 2025

chore: upgrade pflags v1.0.9 #2305

Merged

This was referenced Sep 4, 2025

fix(deps): update module github.com/spf13/cobra to v1.10.1 koki-develop/gat#208

Merged

fix(deps): update module github.com/spf13/cobra to v1.10.1 - autoclosed koki-develop/clive#185

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump pflag to 1.0.8 #2303

Bump pflag to 1.0.8 #2303

tomasaschan commented Aug 31, 2025

Uh oh!

CLAassistant commented Aug 31, 2025 •

edited

Loading

Uh oh!

nadeemc commented Aug 31, 2025

Uh oh!

marckhouzam commented Aug 31, 2025

Uh oh!

marckhouzam left a comment

Uh oh!

Uh oh!

nadeemc commented Aug 31, 2025

Uh oh!

marckhouzam commented Aug 31, 2025

Uh oh!

nadeemc commented Aug 31, 2025

Uh oh!

tomasaschan commented Sep 1, 2025

Uh oh!

jpmcb commented Sep 1, 2025

Uh oh!

tomasaschan commented Sep 1, 2025

Uh oh!

Uh oh!

Bump pflag to 1.0.8 #2303

Bump pflag to 1.0.8 #2303

Conversation

tomasaschan commented Aug 31, 2025

Uh oh!

CLAassistant commented Aug 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nadeemc commented Aug 31, 2025

Uh oh!

marckhouzam commented Aug 31, 2025

Uh oh!

marckhouzam left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nadeemc commented Aug 31, 2025

Uh oh!

marckhouzam commented Aug 31, 2025

Uh oh!

nadeemc commented Aug 31, 2025

Uh oh!

tomasaschan commented Sep 1, 2025

Uh oh!

jpmcb commented Sep 1, 2025

Uh oh!

tomasaschan commented Sep 1, 2025

Uh oh!

Uh oh!

CLAassistant commented Aug 31, 2025 •

edited

Loading