build(deps): upgrade gitlab.com/gitlab-org/labkit to v1.65.3

Jason Plumrequested to merge
labkit-1-65-3 into master

What does this MR do?

Keep the gitlab.com/gitlab-org/labkit dependency current. The upgrade moves labkit from v1.64.10 to v1.65.3.

The registry imports labkit v1 only. Almost all of the release range applies to the labkit v2 module, which this project does not import. labkit/fips is the one v1 package in use that changed, and the registry calls only fips.Check() and fips.Enabled(). Runtime behaviour is unchanged.

labkit v1.65.3 raises its own minimum versions. Minimal version selection therefore also moves eight direct dependencies, and go mod tidy drops four indirect entries that are no longer required. No source file changes are necessary.

Testing

All commands run on the branch. Go 1.25.11 on darwin/arm64, except the BoringCrypto rows, which run in a golang:1.25 container on linux/amd64.

Check Result
go build ./... pass
go vet ./... pass
make lint (golangci-lint v2.13.1) pass, 0 issues
make test (-count=1) pass, 59 packages
go build -tags fips ./... pass
go vet -tags fips ./... pass
GOFIPS140=v1.0.0 go build -tags fips ./cmd/registry pass
GOOS=linux GOARCH=amd64 go build -tags fips ./... pass
CGO_ENABLED=1 GOEXPERIMENT=boringcrypto go build -tags fips ./cmd/registry pass, 534 crypto/internal/boring symbols linked

Both FIPS backends were also started, not only compiled. The registry logs the expected line from fips.Check() at boot:

  • Native module (GOFIPS140=v1.0.0, -tags fips): FIPS mode is enabled. Using the native Go Cryptographic Module.
  • BoringCrypto (GOEXPERIMENT=boringcrypto, -tags fips, linux/amd64): FIPS mode is enabled. Using an external SSL library.

make test needs AWS credentials in the environment. Without them, TestS3DriverPathStyle fails on master as well, because the AWS SDK falls back to EC2 IMDS. TestPurgeSome is a pre-existing flake: it also fails on master under go test -count=5 -run TestPurgeSome ./registry/storage/.

Out of scope

LABKIT_VALIDATE_VERSION in the Makefile pins the labkit/v2 validate-log-fields tool at v2.29.2. That is a separate module and a lint tool only, so this MR does not move it.

Author checklist

  • CODEOWNERS Review: This MR requires approval from at least one CODEOWNER per category/file.
    • If codeowners are absent or the change is urgent, any registry maintainer can temporarily disable CODEOWNERS reviews in the project settings. When doing so:
      • Add a comment on the MR justifying the bypass
      • Mention/CC the designated codeowners in the MR for async review
      • Re-enable CODEOWNERS reviews in project settings once the MR is merged
    • If you lack permissions to disable CODEOWNERS reviews, reach out to the Engineering Manager (@jaime) or Senior Engineering Manager (@crystalpoole) for assistance.
  • Assign one of conventional-commit prefixes to the MR.
    • fix: Indicates a bug fix, triggers a patch release.
    • feat: Signals the introduction of a new feature, triggers a minor release.
    • perf: Focuses on performance improvements that don't introduce new features or fix bugs, triggers a patch release.
    • docs: Updates or changes to documentation. Does not trigger a release.
    • style: Changes that do not affect the code's functionality. Does not trigger a release.
    • refactor: Modifications to the code that do not fix bugs or add features but improve code structure or readability. Does not trigger a release.
    • test: Changes related to adding or modifying tests. Does not trigger a release.
    • chore: Routine tasks that don't affect the application, such as updating build processes, package manager configs, etc. Does not trigger a release.
    • build: Changes that affect the build system or external dependencies. May trigger a release.
    • ci: Modifications to continuous integration configuration files and scripts. Does not trigger a release.
    • revert: Reverts a previous commit. It could result in a patch, minor, or major release.
  • MR contains database changes including schema/background migrations:
    • Do not include code that depends on the schema migrations in the same commit. Split the MR into two or more.
    • Do not include code that depends on background migrations in the same release.
    • Manually run up and down migrations in a postgres.ai production database clone and add a link for the query plan(s) to the MR.
    • If adding new schema migrations make sure the REGISTRY_SELF_MANAGED_RELEASE_VERSION CI variable in migrate.yml is pointing to the latest GitLab self-managed released registry version. Find the correct registry version here. Make sure to select the branch of the latest GitLab release.
    • If adding new queries, extract a query plan from postgres.ai and post the link here. If changing existing queries, also extract a query plan for the current version for comparison.
      • I do not have access to postgres.ai and have made a comment on this MR asking for these to be run on my behalf.
    • If adding new background migration, follow the guide for performance testing new background migrations and add a report/summary to the MR with your analysis.
  • Change contains a breaking change - apply the breaking change label.
  • Change is considered high risk - apply the label high-risk-change
  • I created or linked to an existing issue for every added or updated TODO, BUG, FIXME or OPTIMIZE prefixed comment
  • Changes cannot be rolled back
    • Apply the label cannot-rollback.
    • Add a section to the MR description that includes the following details:
      • The reasoning behind why a release containing the presented MR can not be rolled back (e.g. schema migrations or changes to the FS structure)
      • Detailed steps to revert/disable a feature introduced by the same change where a migration cannot be rolled back. (note: ideally MRs containing schema migrations should not contain feature changes.)
      • Ensure this MR does not add code that depends on these changes that cannot be rolled back.
Documentation/resources

Code review guidelines

Go Style guidelines

Feature flags

When documentation is required

Documentation workflow

Reviewer checklist

  • Ensure the commit and MR tittle are still accurate.
  • If the change contains a breaking change, verify the breaking change label.
  • If the change is considered high risk, verify the label high-risk-change
  • Identify if the change can be rolled back safely. (note: all other reasons for not being able to rollback will be sufficiently captured by major version changes).

🤖 Generated with Claude Code

Merge request reports