chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0 in the kubernetes group

[dependabot]

Bumps the kubernetes group with 1 update: sigs.k8s.io/controller-runtime.

Updates sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.25.0

Highlights

This version of controller-runtime introduces a new experimental ReadYourWritesConsistency feature, which ensures that all writes are reflected in subsequent reads from the default cache-backed client. Stale client reads are arguably the biggest source of friction and sometimes bugs for controller authors, providing this functionality at the library level eliminates that class of problems entirely.

Try it out by setting Client.EnableReadYourWritesConsistency: new(true) in your manager and leave any feedback you may have on the tracking issue.

⚠️ Breaking Changes

• Dependencies: Bump to k8s.io/* v1.37 (#3579 #3575 #3567 #3561 #3547 #3529 #3524)
• Events: Add new EventRecorder interface (#3509)

✨ New Features

• Client: Add a read-your-own-writes client (#3472)
• Fakeclient: Add WithGlobalResourceVersionCounter (#3581)
• Fakeclient: Add scale subresource support for Apply (#3569)
• Metrics: Allow opt-in for client-go REST client metrics (#3510)
• Metrics: Allow overriding client-go REST client metrics latency histogram buckets (#3573)
• Source: Add TypedInformer source (#3520)
• Webhooks: Allow to disable the webhook server by setting the port to -1 (#3481)

🐛 Bug Fixes

• Cache: Fix goroutine leaks in cache Start() methods (#3565)
• Client: Fix regression in Apply typed error handling (#3515)
• Controller: Unlock when Controller.Start() returns with error (#3545)
• Envtest: Fix envtest process stop on Windows (#3519)
• Fakeclient: Allow updating managedFields through Update (#3585)
• Fakeclient: Fix AddIndex panic when wrapped with an interceptor (#3583)
• Fakeclient: Fix PartialObjectMeta handling (#3571)
• Fakeclient: Support scale subresource get/update for unstructured objects (#3546)
• Fakeclient: Update object on subresource apply (#3570)
• PriorityQueue: Fix PriorityQueue deadlock on shutdown (#3540)
• Testing/Process: Fix process Stop timeout error handling (#3523)

🌱 Others

• LeaderElection: Pass Managers Logger to Leader Elector via Context (#3576)

🌱 CI & linters

• Add copyright header validation & fix findings (#3544)
• Bump to golangci-lint v2.12.1 (#3514)
• Bump to golangci-lint v2.12.2 (#3532)
• Bump to golangci-lint v2.13.1 (#3580)

... (truncated)

Commits

• e8f9455 🐛 fakeclient: Allow updating managedFields through Update (#3585)
• 0cc1315 Merge pull request #3565 from dongjiang1989/fix-leak
• fa96780 🐛 Fix goroutine leaks in cache Start() methods
• 1f5514b ✨ Add a read-your-own-write client (#3472)
• df386c7 🌱 Bump to golangci-lint v2.13.1 (#3580)
• dc7618f Merge pull request #3583 from pujitha24/auto/issue-3582
• 37fe235 🐛 fake: fix AddIndex panic when client is wrapped with an interceptor
• 01c7782 ✨ Allow overriding REST client latency histogram buckets (#3573)
• 857be80 Merge pull request #3576 from demirdilek/fix-leaderelection-contextual-logging
• b1387be Merge pull request #3581 from alvaroaleman/fake-consistent
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

Parked on the Kubernetes dependency compatibility gate

Exact head 73d6ffffbea6219611e821b68db99ad12879da73 is not failing because of a transient runner problem. Its Linux build reproduces the dependency-graph incompatibility tracked by #6728:

• controller-runtime 0.25 pulls the Kubernetes 0.37 API family while k8s.io/component-helpers remains on 0.36.4, producing the NodeAllocatableResourceClaimStatus.Resources compile failure;
• github.com/loft-sh/apiserver still implements the older RESTUpdateStrategy.AllowCreateOnUpdate() signature, so it cannot compile against the Kubernetes 0.37 apiserver interface.

The PR is also conflicted with current main, but refreshing the branch cannot resolve those upstream API-contract mismatches. Keep this update parked while #6728 remains open. Once that blocker closes, refresh from main and re-run the full build, lint, vulnerability, and system-test matrix before allowing auto-merge.

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: #6728 | upstream | last-verified 2026-09-12: not shipped — loft-sh/apiserver still publishes zero tags

This PR had no blocker record at all, which meant it was being skipped each run without a
re-verifiable reason — the state the blocker-line convention exists to prevent. Recording one now.

Verified live this run via the module proxy (non-repository source): loft-sh/apiserver@v/list
returns 0 bytes, against a control read of loft-sh/vcluster@v/list returning 9463 bytes, so the
empty result is a genuine absence of published tags rather than an unresponsive proxy.

Why this bump is blocked by that: this PR moves sigs.k8s.io/controller-runtime 0.24.1→0.25.0,
which pulls k8s.io/apiserver forward, while vcluster pins k8s.io/apiserver v0.36.0 through an
untagged loft-sh/apiserver pseudo-version. Until that dependency publishes a tag, the two cannot
be satisfied together, which is why the whole suite fails to build rather than one test failing.

Same family as #6845 and #6826 — all three clear together when #6728 does. Their red CI is a stale
artifact of this one blocker, not three separate failures and not a systemic ksail CI defect.