Bump the kubernetes group across 1 directory with 6 updates#544
Bump the kubernetes group across 1 directory with 6 updates#544dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the kubernetes group with 3 updates in the / directory: [k8s.io/api](https://github.com/kubernetes/api), [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) and [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime). Updates `k8s.io/api` from 0.35.4 to 0.36.1 - [Commits](kubernetes/api@v0.35.4...v0.36.1) Updates `k8s.io/apiextensions-apiserver` from 0.35.4 to 0.36.1 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](kubernetes/apiextensions-apiserver@v0.35.4...v0.36.1) Updates `k8s.io/apimachinery` from 0.35.4 to 0.36.1 - [Commits](kubernetes/apimachinery@v0.35.4...v0.36.1) Updates `k8s.io/client-go` from 0.35.4 to 0.36.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.35.4...v0.36.1) Updates `k8s.io/utils` from 0.0.0-20251002143259-bc988d571ff4 to 0.0.0-20260210185600-b8788abfbbc2 - [Commits](https://github.com/kubernetes/utils/commits) Updates `sigs.k8s.io/controller-runtime` from 0.23.3 to 0.24.1 - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](kubernetes-sigs/controller-runtime@v0.23.3...v0.24.1) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/apimachinery dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/client-go dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/utils dependency-version: 0.0.0-20260210185600-b8788abfbbc2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: kubernetes - dependency-name: sigs.k8s.io/controller-runtime dependency-version: 0.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
area/dependency
WalkthroughThis PR updates ChangesDependency Version Upgrade
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 85: The go.mod currently pins a pseudo-version for the protobuf module
(google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af) which
weakens reproducibility; update go.mod to use the latest stable semver (e.g.,
google.golang.org/protobuf v1.36.11) and then run `go mod tidy`/`go get` to
re-resolve dependencies, or if that exact commit is truly required, add a short
justification comment in the repository docs and a go.mod comment explaining why
the pseudo-version was chosen; locate the google.golang.org/protobuf entry in
go.mod to make this change.
- Line 91: Add a short rationale entry to the PR/commit message and project
dependency review describing why k8s.io/streaming v0.36.1 is present (use the
exact module string "k8s.io/streaming v0.36.1" and the output from running `go
mod why -m k8s.io/streaming` which shows it is pulled via
`k8s.io/client-go/tools/remotecommand -> k8s.io/streaming/pkg/httpstream`,
`github.com/openshift/managed-cluster-validating-webhooks/test/e2e`, and
`sigs.k8s.io/e2e-framework/klient/k8s/resources`), and append the dependency
review trail with the license information for k8s.io/streaming v0.36.1 (name and
compatibility) plus a known-CVE check for that exact version (e.g.,
results/links from osv.dev or equivalent vulnerability database) so the PR
includes both the “why” and security/license verification.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 61e62022-f0a8-4472-bdab-a80b7304a484
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| golang.org/x/time v0.14.0 // indirect | ||
| golang.org/x/tools v0.45.0 // indirect | ||
| google.golang.org/protobuf v1.36.11 // indirect | ||
| google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check whether a stable tagged protobuf version can replace the pseudo-version
set -euo pipefail
curl -fsSL https://proxy.golang.org/google.golang.org/protobuf/@v/list | tail -n 30
echo "Current go.mod entry:"
rg -n 'google\.golang\.org/protobuf' go.modRepository: openshift/managed-cluster-validating-webhooks
Length of output: 439
🏁 Script executed:
#!/bin/bash
set -euo pipefail
mod="google.golang.org/protobuf"
# Fetch version list once and query for the stable tag(s) around the pseudo-version base
versions="$(curl -fsSL "https://proxy.golang.org/${mod}/@v/list")"
echo "Has stable v1.36.12 tag? =>"
echo "$versions" | rg -n '^v1\.36\.12$' || echo "NO"
echo
echo "Closest stable tags to v1.36.12 (sorted):"
# Extract v1.36.xx stable tags (exclude pseudo versions) and show a small window
echo "$versions" | rg '^v1\.36\.[0-9]+$' | sort -V | tail -n 10
echo
echo "Has later stable tags beyond v1.36.12? (show last 10 stable tags overall)"
echo "$versions" | rg '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 10
echo
echo "Current go.mod entry:"
rg -n 'google\.golang\.org/protobuf' go.modRepository: openshift/managed-cluster-validating-webhooks
Length of output: 507
Avoid pseudo-version protobuf in production dependency set
go.mod pins google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect, which is a Go pseudo-version (not a stable semver tag). The module proxy lists no stable v1.36.12 tag, with the latest stable protobuf tags ending at v1.36.11, so this pin tracks an untagged commit and weakens reproducibility versus stable releases.
- Prefer
google.golang.org/protobuf v1.36.11(or the latest available stable) and re-resolve deps, or add explicit justification for why this specific pseudo-version is required.
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 85, The go.mod currently pins a pseudo-version for the
protobuf module (google.golang.org/protobuf
v1.36.12-0.20260120151049-f2248ac996af) which weakens reproducibility; update
go.mod to use the latest stable semver (e.g., google.golang.org/protobuf
v1.36.11) and then run `go mod tidy`/`go get` to re-resolve dependencies, or if
that exact commit is truly required, add a short justification comment in the
repository docs and a go.mod comment explaining why the pseudo-version was
chosen; locate the google.golang.org/protobuf entry in go.mod to make this
change.
| k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect | ||
| k8s.io/component-base v0.36.1 // indirect | ||
| k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect | ||
| k8s.io/streaming v0.36.1 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Identify why k8s.io/streaming was introduced in module graph and gather license metadata reference points
set -euo pipefail
rg -n 'k8s\.io/streaming' go.mod go.sum
echo "If available in your environment, run: go mod graph | rg 'k8s.io/streaming'"Repository: openshift/managed-cluster-validating-webhooks
Length of output: 388
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n 'k8s\.io/streaming' go.mod go.sum
go mod why -m k8s.io/streamingRepository: openshift/managed-cluster-validating-webhooks
Length of output: 513
Add dependency rationale + complete license/security trail for k8s.io/streaming v0.36.1 (indirect)
go.mod:91 introduces k8s.io/streaming v0.36.1 // indirect (checksummed in go.sum). go mod why -m k8s.io/streaming shows it’s pulled via:
k8s.io/client-go/tools/remotecommand→k8s.io/streaming/pkg/httpstreamgithub.com/openshift/managed-cluster-validating-webhooks/test/e2esigs.k8s.io/e2e-framework/klient/k8s/resources
Add brief PR evidence for this “why” (from go mod why) and extend the dependency review trail to include license compatibility for k8s.io/streaming v0.36.1 and a known-CVE check for that exact version (e.g., via osv.dev).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 91, Add a short rationale entry to the PR/commit message and
project dependency review describing why k8s.io/streaming v0.36.1 is present
(use the exact module string "k8s.io/streaming v0.36.1" and the output from
running `go mod why -m k8s.io/streaming` which shows it is pulled via
`k8s.io/client-go/tools/remotecommand -> k8s.io/streaming/pkg/httpstream`,
`github.com/openshift/managed-cluster-validating-webhooks/test/e2e`, and
`sigs.k8s.io/e2e-framework/klient/k8s/resources`), and append the dependency
review trail with the license information for k8s.io/streaming v0.36.1 (name and
compatibility) plus a known-CVE check for that exact version (e.g.,
results/links from osv.dev or equivalent vulnerability database) so the PR
includes both the “why” and security/license verification.
|
/retest |
|
/retest |
1 similar comment
|
/retest |
|
@dependabot[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Bumps the kubernetes group with 3 updates in the / directory: k8s.io/api, k8s.io/apiextensions-apiserver and sigs.k8s.io/controller-runtime.
Updates
k8s.io/apifrom 0.35.4 to 0.36.1Commits
25001c8Update dependencies to v0.36.1 tag879d396Merge remote-tracking branch 'origin/master' into release-1.36030d81fUpdate github.com/moby/spdystream from v0.5.0 to v0.5.1aef6eb6Add granular authorization for DRA ResourceClaim status updates91061eaMerge pull request #136589 from tosi3k/preemption-modee6b81e2Add Workload-Aware Preemption fields to Workload and PodGroup APIsf8fce2eMerge pull request #136989 from nojnhuh/podgroup-resourceclaimb928f5eWorkload API: PodGroup ResourceClaims (KEP-5729)61bd78eMerge pull request #137190 from everpeace/KEP-5491-alpha6bf46ebMerge pull request #137028 from nmn3m/feature/dra-resource-pool-statusUpdates
k8s.io/apiextensions-apiserverfrom 0.35.4 to 0.36.1Commits
5b822b1Update dependencies to v0.36.1 tag4cd8c3dMerge remote-tracking branch 'origin/master' into release-1.36c2fd557Merge pull request #138346 from dashpole/update_otel_prop1daa309Merge remote-tracking branch 'origin/master' into release-1.361551264Update github.com/moby/spdystream from v0.5.0 to v0.5.16c97d2bupdate go.opentelemetry.io/otel to v1.41.0862c52aupdate google.golang.org/grpc to v1.79.3abac065Merge pull request #137849 from bryantbiggs/deps/update-kube-openapi7acee75Merge pull request #137843 from pacoxu/cobra-v1.10.2612f1d8dependencies: bump kube-openapi to drop ginkgo/gomega indirect depsUpdates
k8s.io/apimachineryfrom 0.35.4 to 0.36.1Commits
7af103aUpdate dependencies to v0.36.1 tagefb7f26Merge remote-tracking branch 'origin/master' into release-1.36d966e56Update github.com/moby/spdystream from v0.5.0 to v0.5.179b3632Merge pull request #137864 from yongruilin/dv-dra-mismatcha8822f7Add slice and map union member support with tests7dba2d0Use IsZero instead of IsNil for union ratcheting checkd95710fFix union validation ratcheting when oldObj is nil729062dMerge pull request #137849 from bryantbiggs/deps/update-kube-openapi13b12e6dependencies: bump kube-openapi to drop ginkgo/gomega indirect deps27f4670Merge pull request #136657 from Jefftree/sharding-testUpdates
k8s.io/client-gofrom 0.35.4 to 0.36.1Commits
55ef15aUpdate dependencies to v0.36.1 tagf22a53eMerge remote-tracking branch 'origin/master' into release-1.36a948641Update github.com/moby/spdystream from v0.5.0 to v0.5.17e44ffcAdd Workload-Aware Preemption fields to Workload and PodGroup APIsdf2d882Merge pull request #136989 from nojnhuh/podgroup-resourceclaim4eece52Workload API: PodGroup ResourceClaims (KEP-5729)3d35c51Merge pull request #137190 from everpeace/KEP-5491-alpha0434117Merge pull request #137028 from nmn3m/feature/dra-resource-pool-statusba785beDrop CSR analogy, mark ObjectMeta +required,reduce limits (maxItems=500, maxL...4a9c878Add ResourcePoolStatusRequest API types and generated codeUpdates
k8s.io/utilsfrom 0.0.0-20251002143259-bc988d571ff4 to 0.0.0-20260210185600-b8788abfbbc2Commits
Updates
sigs.k8s.io/controller-runtimefrom 0.23.3 to 0.24.1Release notes
Sourced from sigs.k8s.io/controller-runtime's releases.
... (truncated)
Commits
3be3f1bMerge pull request #3516 from k8s-infra-cherrypick-robot/cherry-pick-3515-to-...0f7b33dFix regression in Apply typed error handlingd3eaef3Merge pull request #3475 from alvaroaleman/fixfix3296f32🐛 Update typed Applyconfigurations with server responsec8b4b9dMerge pull request #3506 from troy0820/troy0820/update-deps-k8s557c314update to k8s.io v1.36.0e4a998cMerge pull request #3499 from kubernetes-sigs/dependabot/github_actions/all-g...1a31c56Merge pull request #3498 from vieux/fix-fake-client-generatename-retry80bc294fakeclient: retry GenerateName on AlreadyExists collisions (match K8s 1.32 be...77b730a🌱 Bump the all-github-actions group with 2 updatesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit