chore(deps): update module github.com/casbin/casbin/v2 to v3

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/casbin/casbin/v2	v2.135.0 → v3.10.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

casbin/casbin (github.com/casbin/casbin/v2)

v3.10.0

Compare Source

Features

• add Explain() API to explain the authorization decisions via LLM API (#​1678) (0fe9505)

v3.9.0

Compare Source

Features

• integrate default detector into Enforcer (#​1665) (6cfc463)

v3.8.2

Compare Source

Bug Fixes

• improve CI benchmark table in PR (#​1663) (f1f03cc)

v3.8.1

Compare Source

Bug Fixes

• fix "Undefined function g" error by copying RM fields in Assertion.copy() (#​1658) (9324df7)

v3.8.0

Compare Source

Features

• add GetAllUsers() API to separate users from roles (#​1652) (1aba8b9)

v3.7.0

Compare Source

Features

• add logger integration to Casbin core enforcement and policy APIs (#​1651) (b190fce)

v3.6.0

Compare Source

Bug Fixes

• add new Logger interface (#​1639) (6b688f0)

Features

• add DefaultLogger (#​1648) (61c876f)
• remove legacy logger implementation (#​1638) (2d7173f)

v3.5.2

Compare Source

Bug Fixes

• remove opencollective links in README (ea5872b)

v3.5.1

Compare Source

Bug Fixes

• add DefaultDetector with DFS-based RBAC cycle detection (#​1632) (c407251)

v3.5.0

Compare Source

Features

• remove github-action-benchmark workflow from CI (#​1631) (53fb4e4)

v3.4.2

Compare Source

Bug Fixes

• add Detector interface (#​1629) (0b35dfa)

v3.4.1

Compare Source

Bug Fixes

• disable benchmark comments on merged commits (#​1615) (b3f4490)

v3.4.0

Compare Source

Features

• fix enforcement failure when renaming domain parameter from 'dom' to arbitrary names (#​1611) (0fd3ee8)

v3.3.0

Compare Source

Features

• add performance comparison CI for pull requests (#​1613) (4d32aaf)

v3.2.0

Compare Source

Features

• return clear error for invalid JSON when EnableAcceptJsonRequest is enabled (#​1610) (80dccb7)

v3.1.0

Compare Source

Features

• add "constraint_definition" section for RBAC policy validation (#​1600) (65d4097)

v3.0.1

Compare Source

Bug Fixes

• improve line ending for TestCasbinJsGetPermissionForUser() (#​1597) (cc7d03a)

v3.0.0

Compare Source

• feat!: upgrade to Casbin v3 (#​1595) (3ced5d7), closes #​1595

BREAKING CHANGES

• Module path changed from github.com/casbin/casbin/v2 to github.com/casbin/casbin/v3. All import paths must be updated to use v3.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:46 PM UTC · Completed 10:56 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

Review

Findings

Critical

• [logic-error] go.mod:39 — The PR title claims to update casbin/casbin/v2 to v3, but the actual diff downgrades casbin/casbin/v2 from v2.135.0 to v2.102.0 (33 minor versions backward). The module path remains github.com/casbin/casbin/v2 — there is no migration to a v3 module path (github.com/casbin/casbin/v3). The casbin v3.0.0 release notes explicitly state the module path changed to /v3, so a proper v3 upgrade would require changing the import path. This PR neither accomplishes its stated goal nor produces a safe change — the downgrade may reintroduce bugs fixed in the 33 skipped releases. This appears to be a Renovate bot misconfiguration.
  Remediation: Reject this PR. Either (a) properly migrate to casbin/casbin/v3 by changing the module path and updating all transitive dependency references, or (b) keep the existing v2.135.0 since casbin is an indirect dependency managed by ArgoCD's requirements.
  See also: [scope-mismatch] and [unauthorized-downgrade] findings at this location.

Medium

• [missing-authorization] go.mod:39 — No linked issue exists to authorize this dependency change. While casbin is an indirect dependency not directly used by this project, downgrading any transitive dependency by 33 minor versions warrants explicit rationale documenting why the downgrade is needed and confirming no regressions are introduced.

Low

• [dependency-integrity] go.sum:65 — The go.sum file adds a new entry for github.com/casbin/govaluate v1.2.0/go.mod while retaining the existing v1.3.0 entry. This is standard Go module behavior (recording checksums for all versions in the module graph), but is a side effect of the questionable downgrade.

• [transitive-dependency-risk] go.mod:39 — Casbin is a transitive dependency via argoproj/argo-cd/v2 v2.14.21 and is not directly imported by any Go source file in this project. Go's minimum version selection (MVS) algorithm would override this pin if any direct or transitive dependency requires a higher version, making the manual pin potentially ineffective or misleading.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[critical] logic-error

The PR title claims to update casbin/casbin/v2 to v3, but the actual diff downgrades casbin/casbin/v2 from v2.135.0 to v2.102.0 (33 minor versions backward). The module path remains github.com/casbin/casbin/v2 with no migration to a v3 module path. This PR neither accomplishes its stated goal nor produces a safe change. This appears to be a Renovate bot misconfiguration.

Suggested fix: Reject this PR. Either properly migrate to casbin/casbin/v3 by changing the module path, or keep the existing v2.135.0 since casbin is an indirect dependency managed by ArgoCD's requirements.

[fullsend-ai-review]

[medium] missing-authorization

No linked issue exists to authorize this dependency change. Downgrading a transitive dependency by 33 minor versions warrants explicit rationale documenting why the downgrade is needed.

[fullsend-ai-review]

[low] dependency-integrity

The go.sum file adds a new entry for github.com/casbin/govaluate v1.2.0/go.mod while retaining the existing v1.3.0 entry. This is standard Go module behavior but is a side effect of the questionable downgrade.

[fullsend-ai-review]

[low] transitive-dependency-risk

Casbin is a transitive dependency via argoproj/argo-cd/v2 v2.14.21 and is not directly imported by any Go source file. Go's MVS algorithm would override this pin if any dependency requires a higher version, making the manual pin potentially ineffective.