chore(deps): update module github.com/twmb/franz-go/pkg/kmsg to v2

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/twmb/franz-go/pkg/kmsg	v1.13.1 → v2.0.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • Between 02:00 AM and 04:59 AM, Monday through Friday (* 2-4 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

Walkthrough

The go.mod file replaces the indirect github.com/twmb/franz-go/pkg/kmsg dependency at v1.13.1 with github.com/twmb/franz-go/pkg/kmsg/v2 at v2.0.1.

Changes

Dependency update

Layer / File(s)	Summary
Update kmsg module path go.mod	The indirect dependency changes to github.com/twmb/franz-go/pkg/kmsg/v2 v2.0.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: clcollins, typeid

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Ote Binary Stdout Contract	❌ Error	fips.go:15 calls fmt.Println from init(), writing directly to stdout in the fips_enabled process build.	Replace fmt.Println with an os.Stderr write or a logger configured for stderr before initialization.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only the franz-go module path in go.mod; it adds no Ginkgo tests or test-title changes, and existing titles are static literals.
Test Structure And Quality	✅ Passed	The committed patch changes only go.mod; it adds no Ginkgo It blocks or test setup, cleanup, waits, or assertions to review.
Microshift Test Compatibility	✅ Passed	The PR changes only go.mod; it adds no Ginkgo e2e tests or other test code requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only go.mod; it adds no Ginkgo e2e tests, so the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only an indirect dependency in go.mod; no deployment manifests, operator code, or controllers were added or modified, so this check is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only one go.mod dependency line; it adds no Ginkgo e2e tests or test code requiring IPv4 or external connectivity.
No-Weak-Crypto	✅ Passed	The commit changes only the franz-go kmsg dependency in go.mod; source searches found no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR changes only go.mod. Manifest scans found no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, root-user, or allowPrivilegeEscalation:true settings; images use non-root users.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only one indirect dependency line in go.mod; no executable code, logging statements, or sensitive data changed.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency update from github.com/twmb/franz-go/pkg/kmsg to v2.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/master/github.com-twmb-franz-go-pkg-kmsg-2.x

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 117: The go.mod file has been updated to replace the indirect dependency
kmsg v1.13.1 with kmsg/v2 v2.0.1, but go.sum needs to be synchronized with this
change. Run go mod tidy to update go.sum and remove the old kmsg v1.13.1 entries
while adding the new kmsg/v2 v2.0.1 entries. Additionally, verify and document
in the commit message or pull request why this major version bump upgrade is
necessary, such as whether it is required by another dependency upgrade,
addresses a security concern, or provides needed functionality. If this is a
routine automated dependency update without clear functional benefits, consider
whether the maintenance burden justifies upgrading a transitive dependency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e21eff83-24b7-4d09-8c56-76429d716ac2

📥 Commits

Reviewing files that changed from the base of the PR and between 2b34c8e and 6b386b9.

📒 Files selected for processing (1)

• go.mod

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign rbhilare for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[nephomaniac]

/retest

[openshift-ci]

@red-hat-konflux[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/test	cc68321	link	true	/test test
ci/prow/validate	cc68321	link	true	/test validate
ci/prow/lint	cc68321	link	true	/test lint
ci/prow/osd-gcp-e2e	cc68321	link	true	/test osd-gcp-e2e
ci/prow/rosa-sts-e2e	cc68321	link	true	/test rosa-sts-e2e
ci/prow/images	cc68321	link	true	/test images
ci/prow/coverage	cc68321	link	true	/test coverage

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[nephomaniac]

Module path change (franz-go/kmsg v1 → v2) on an indirect dep. Upstream transitive deps haven't migrated — will break the build.