chore(deps): update module github.com/ryancurrah/gomodguard to v2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/ryancurrah/gomodguard	v1.4.1 → v2.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

ryancurrah/gomodguard (github.com/ryancurrah/gomodguard)

v2.1.0

Compare Source

Note: v2.0.0 and v2.0.1 have been retracted. Please use v2.1.0 or later.

Breaking changes

New configuration schema. The .gomodguard.yaml format has been redesigned. Run gomodguard migrate to automatically convert a v1 config to v2.

Before (v1):

allowed:
  modules:
    - github.com/foo/bar
  domains:
    - golang.org

blocked:
  modules:
    - github.com/uudashr/go-module:
        recommendations:
          - golang.org/x/mod
        reason: "use the official library"
  versions:
    - github.com/mitchellh/go-homedir:
        version: "<= 1.1.0"
        reason: "old versions have a bug"

  local_replace_directives: true

After (v2):

allowed:
  - module: github.com/foo/bar
  - module: golang.org
    match-type: prefix

blocked:
  - module: github.com/uudashr/go-module
    recommendations:
      - golang.org/x/mod
    reason: "use the official library"
  - module: github.com/mitchellh/go-homedir
    version: "<= 1.1.0"
    reason: "old versions have a bug"

local_replace_directives: true

Key differences:

• allowed.modules and allowed.domains are replaced by a flat list where each entry has a module field and an optional match-type field (exact, prefix, regex)
• blocked.modules and blocked.versions are merged into a single flat list where each entry has a module field
• match_type is now match-type (hyphen, not underscore)
• local_replace_directives moves from blocked to the top level

New features

Layered match type precedence. Rules can now match by exact (default), prefix, or regex. When multiple rules overlap, exact beats prefix beats regex, with longest prefix winning among prefix rules.

Regex support. Block or allow entire namespaces with regex patterns:

blocked:
  - module: "github.com/badcompany/.*"
    match-type: regex
    reason: "not permitted"

local_replace_directives. Block modules with local filesystem replace directives to catch accidental commits of dev overrides. Multi-module repo aware — sibling modules whose replacement path contains a matching go.mod are automatically permitted.

The gomodguard migrate command converts a v1 .gomodguard.yaml to v2 format and prints to stdout.

-version flag. Prints the installed version.

Split module layout. The library (github.com/ryancurrah/gomodguard/v2) and CLI (github.com/ryancurrah/gomodguard/cmd/gomodguard/v2) are now separate Go modules, allowing the library to be imported without pulling in CLI dependencies.

Changelog

• 082be15 feat: use array with module field for allowed and blocked config

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.7%. Comparing base (624f646) to head (51c7435).

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #8104     +/-   ##
=======================================
- Coverage   81.7%   81.7%   -0.1%     
=======================================
  Files        308     308             
  Lines      23655   23655             
=======================================
- Hits       19344   19341      -3     
- Misses      3929    3932      +3     
  Partials     382     382             

see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dmathieu]

This upgrades an indirect dependency with a path change.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 2.x releases. But if you manually upgrade to 2.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.