build(deps): bump the kubernetes group across 1 directory with 3 updates - #560
build(deps): bump the kubernetes group across 1 directory with 3 updates#560dependabot[bot] wants to merge 1 commit into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
ok-to-test
WalkthroughThis PR updates the Go toolchain from 1.25.0 to 1.26.0 and revises Kubernetes, e2e-framework, and related transitive dependency versions in ChangesGo and Kubernetes dependency refresh
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/retest |
907d967 to
f4ad1c0
Compare
f4ad1c0 to
d304870
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 88: Replace the pseudo-version for google.golang.org/protobuf in go.mod
with an approved released, non-yanked version, preserving the module’s indirect
dependency declaration.
- Around line 21-25: Align the Kubernetes dependencies in go.mod by moving the
mismatched k8s.io/apimachinery and k8s.io/streaming entries to the same v0.35
minor release line as k8s.io/api and k8s.io/client-go. Keep controller-runtime
v0.23.3 compatible with the unified Kubernetes dependency set and update all
relevant entries consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 53c4633d-de03-40b8-b722-4d96619b4a02
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| k8s.io/api v0.35.3 | ||
| k8s.io/apimachinery v0.36.2 | ||
| k8s.io/client-go v0.35.3 | ||
| k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 | ||
| sigs.k8s.io/e2e-framework v0.7.0 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
set -euo pipefail
echo '--- go.mod relevant lines ---'
nl -ba go.mod | sed -n '1,140p' | sed -n '15,105p'
echo
echo '--- Kubernetes-related module versions in go.mod ---'
rg -n '^(require|replace|exclude|module)|k8s.io/|sigs.k8s.io/controller-runtime|google.golang.org/protobuf' go.modRepository: openshift/osde2e-common
Length of output: 231
🏁 Script executed:
python3 - <<'PY'
import json, urllib.request, sys
urls = [
"https://raw.githubusercontent.com/kubernetes-sigs/controller-runtime/main/README.md",
"https://raw.githubusercontent.com/kubernetes-sigs/controller-runtime/release-0.23/README.md",
]
for u in urls:
print(f"=== {u} ===")
try:
with urllib.request.urlopen(u, timeout=20) as r:
data = r.read().decode("utf-8", "replace")
for needle in ["Kubernetes v0.35", "Kubernetes v0.36", "compatibility", "v0.23"]:
idx = data.find(needle)
if idx != -1:
start = max(0, idx - 300)
end = min(len(data), idx + 700)
print(data[start:end])
break
else:
print("needle not found")
except Exception as e:
print("ERR", e)
PYRepository: openshift/osde2e-common
Length of output: 629
🏁 Script executed:
python3 - <<'PY'
import urllib.request, json
# Query Kubernetes sigs controller-runtime docs page for the compatibility matrix.
urls = [
"https://pkg.go.dev/sigs.k8s.io/controller-runtime?tab=versions",
"https://github.com/kubernetes-sigs/controller-runtime/blob/main/README.md",
]
for url in urls:
print("URL:", url)
try:
with urllib.request.urlopen(url, timeout=20) as r:
data = r.read().decode("utf-8", "replace")
for needle in ["v0.23", "Kubernetes", "1.35", "1.36", "compatibility"]:
i = data.find(needle)
if i != -1:
print(data[max(0,i-200):min(len(data),i+1200)])
break
else:
print("no needle found")
except Exception as e:
print("ERR", e)
PYRepository: openshift/osde2e-common
Length of output: 584
🏁 Script executed:
set -euo pipefail
echo '--- go.mod lines 15-105 ---'
sed -n '15,105p' go.mod | cat -n
echo
echo '--- controller-runtime / k8s module lines ---'
grep -nE 'k8s.io/|sigs.k8s.io/controller-runtime|google.golang.org/protobuf' go.modRepository: openshift/osde2e-common
Length of output: 5868
🌐 Web query:
kubernetes-sigs controller-runtime compatibility matrix v0.23 v0.24 Kubernetes v0.35 v0.36
💡 Result:
According to the official documentation for kubernetes-sigs/controller-runtime, the library maintains specific compatibility with Kubernetes (k8s.io/* and client-go) dependencies by creating a new minor version of controller-runtime for each minor version of these dependencies [1][2][3]. The compatibility for the requested versions is as follows: | controller-runtime version | k8s.io/* and client-go version | Minimum Go version | |:--- |:--- |:--- | | v0.24 | v0.36 | 1.26 | | v0.23 | v0.35 | 1.25 | Important notes regarding this compatibility: - Testing: Each minor version of controller-runtime is tested explicitly with its corresponding minor version of client-go [1][4]. - Compatibility: While controller-runtime might technically work with other client-go versions, such configurations are neither supported nor tested by the project [2][3]. - Versioning Policy: The project does not guarantee any particular compatibility matrix between individual Kubernetes library dependencies; it relies on the synchronized minor version releases to maintain stability [3]. For the most up-to-date information or to verify exact dependencies for specific patch releases, you can check the go.mod file in the official controller-runtime repository [1][4].
Citations:
- 1: https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.23.3
- 2: https://github.com/kubernetes-sigs/controller-runtime/blob/main/README.md
- 3: https://github.com/kubernetes-sigs/controller-runtime/blob/main/VERSIONING.md
- 4: https://github.com/kubernetes-sigs/controller-runtime?tab=readme-ov-file
🏁 Script executed:
python3 - <<'PY'
import ssl, urllib.request, re
urls = [
"https://raw.githubusercontent.com/kubernetes-sigs/controller-runtime/main/README.md",
"https://raw.githubusercontent.com/kubernetes-sigs/controller-runtime/release-0.23/README.md",
]
ctx = ssl._create_unverified_context()
for u in urls:
print(f"=== {u} ===")
try:
with urllib.request.urlopen(u, context=ctx, timeout=20) as r:
data = r.read().decode("utf-8", "replace")
for pat in [r'Kubernetes v0\.35', r'Kubernetes v0\.36', r'v0\.23', r'compatibility']:
m = re.search(pat, data, re.I)
if m:
s = max(0, m.start() - 250)
e = min(len(data), m.end() + 900)
print(data[s:e])
break
else:
print("No relevant text found")
except Exception as e:
print("ERR", e)
PYRepository: openshift/osde2e-common
Length of output: 2673
Align the Kubernetes dependency release lines in go.mod (21-25, 94-95). k8s.io/api/client-go are on v0.35.3 while k8s.io/apimachinery/streaming are on v0.36.2; controller-runtime v0.23.3 is only paired with Kubernetes v0.35, so keep the k8s.io/* stack on one minor line before merging.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 21 - 25, Align the Kubernetes dependencies in go.mod by
moving the mismatched k8s.io/apimachinery and k8s.io/streaming entries to the
same v0.35 minor release line as k8s.io/api and k8s.io/client-go. Keep
controller-runtime v0.23.3 compatible with the unified Kubernetes dependency set
and update all relevant entries consistently.
| golang.org/x/time v0.14.0 // indirect | ||
| golang.org/x/tools v0.44.0 // indirect | ||
| google.golang.org/protobuf v1.36.11 // indirect | ||
| google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod excerpt =="
nl -ba go.mod | sed -n '75,95p'
echo
echo "== search for protobuf uses =="
rg -n 'google\.golang\.org/protobuf|protobuf' -S . --glob 'go.mod' --glob '!**/vendor/**'
echo
echo "== module metadata if available =="
go list -m -json google.golang.org/protobuf@v1.36.12-0.20260120151049-f2248ac996af 2>/dev/null || trueRepository: openshift/osde2e-common
Length of output: 222
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
s = Path('go.mod').read_text()
m = re.search(r'google\.golang\.org/protobuf\s+([^\s]+)', s)
print("parsed_version=", m.group(1) if m else "not found")
PYRepository: openshift/osde2e-common
Length of output: 216
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path('go.mod')
for i, line in enumerate(p.read_text().splitlines(), 1):
if 80 <= i <= 92:
print(f"{i:4d}: {line}")
PY
echo
echo "== protobuf-related go.mod entries =="
python3 - <<'PY'
from pathlib import Path
for i, line in enumerate(Path('go.mod').read_text().splitlines(), 1):
if 'protobuf' in line.lower():
print(f"{i:4d}: {line}")
PYRepository: openshift/osde2e-common
Length of output: 917
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
lines = Path('go.mod').read_text().splitlines()
for i in range(80, 93):
if i <= len(lines):
print(f"{i:4d}: {lines[i-1]}")
PYRepository: openshift/osde2e-common
Length of output: 793
Replace the protobuf pseudo-version
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af is a pseudo-version. Pin this to a released, non-yanked version unless there’s an approved exception.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 88, Replace the pseudo-version for google.golang.org/protobuf
in go.mod with an approved released, non-yanked version, preserving the module’s
indirect dependency declaration.
Source: Path instructions
openshift-ci
Bot
added
the
needs-rebase
|
rebase DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
d304870 to
26cd9d8
Compare
openshift-ci
Bot
removed
the
needs-rebase
There was a problem hiding this comment.
♻️ Duplicate comments (2)
go.mod (2)
88-88: 🔒 Security & Privacy | 🟠 MajorReplace the protobuf pseudo-version.
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996afremains a pseudo-version. Use an approved released, non-yanked version and update the corresponding module checksums.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 88, Replace the google.golang.org/protobuf pseudo-version in go.mod with an approved, non-yanked released version, then update its corresponding go.sum checksums to match the selected release.Source: Path instructions
21-25: 🎯 Functional Correctness | 🟠 MajorKeep the Kubernetes dependency family on one supported minor line.
This repeats the previous unresolved finding:
k8s.io/api/client-goare v0.35.3 whilek8s.io/apimachinery/streamingare v0.36.2, butcontroller-runtime v0.23.3is documented for Kubernetes v0.35; Kubernetes v0.36 corresponds to controller-runtime v0.24. Align the Kubernetes modules and controller-runtime before merging. (github.com)Also applies to: 92-95
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 21 - 25, Align the Kubernetes dependency family in go.mod to one supported minor release line: make k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, and any streaming module use v0.35.x to match controller-runtime v0.23.3, or consistently upgrade controller-runtime and all Kubernetes modules to the v0.36-compatible line. Update the related entries together and preserve dependency consistency.
🧹 Nitpick comments (1)
go.mod (1)
21-25: 🔒 Security & Privacy | 🔵 TrivialAdd supply-chain checks for this dependency refresh. CI should cover
go mod verify, OSV/license scanning, SBOM/provenance generation, and Sigstore/cosign signing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 21 - 25, Add CI supply-chain checks for the dependency refresh represented by the Kubernetes and e2e-framework entries in go.mod: run go mod verify, perform OSV and license scans, generate SBOM and provenance artifacts, and sign the relevant artifacts with Sigstore/cosign. Integrate these checks into the existing CI workflow and fail the build when verification or scanning detects an issue.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@go.mod`:
- Line 88: Replace the google.golang.org/protobuf pseudo-version in go.mod with
an approved, non-yanked released version, then update its corresponding go.sum
checksums to match the selected release.
- Around line 21-25: Align the Kubernetes dependency family in go.mod to one
supported minor release line: make k8s.io/api, k8s.io/apimachinery,
k8s.io/client-go, and any streaming module use v0.35.x to match
controller-runtime v0.23.3, or consistently upgrade controller-runtime and all
Kubernetes modules to the v0.36-compatible line. Update the related entries
together and preserve dependency consistency.
---
Nitpick comments:
In `@go.mod`:
- Around line 21-25: Add CI supply-chain checks for the dependency refresh
represented by the Kubernetes and e2e-framework entries in go.mod: run go mod
verify, perform OSV and license scans, generate SBOM and provenance artifacts,
and sign the relevant artifacts with Sigstore/cosign. Integrate these checks
into the existing CI workflow and fail the build when verification or scanning
detects an issue.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 00cf63cf-d9ee-47f5-b6c6-72cf0efc633c
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
openshift-ci
Bot
added
the
needs-rebase
|
rebase DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Bumps the kubernetes group with 2 updates in the / directory: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) and [sigs.k8s.io/e2e-framework](https://github.com/kubernetes-sigs/e2e-framework). Updates `k8s.io/apimachinery` from 0.35.2 to 0.36.3 - [Commits](kubernetes/apimachinery@v0.35.2...v0.36.3) Updates `k8s.io/utils` from 0.0.0-20251002143259-bc988d571ff4 to 0.0.0-20260210185600-b8788abfbbc2 - [Commits](https://github.com/kubernetes/utils/commits) Updates `sigs.k8s.io/e2e-framework` from 0.6.0 to 0.7.0 - [Release notes](https://github.com/kubernetes-sigs/e2e-framework/releases) - [Changelog](https://github.com/kubernetes-sigs/e2e-framework/blob/main/RELEASE.md) - [Commits](kubernetes-sigs/e2e-framework@v0.6.0...v0.7.0) --- updated-dependencies: - dependency-name: k8s.io/apimachinery dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/utils dependency-version: 0.0.0-20260210185600-b8788abfbbc2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: kubernetes - dependency-name: sigs.k8s.io/e2e-framework dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes ... Signed-off-by: dependabot[bot] <support@github.com>
26cd9d8 to
50f0a32
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
@dependabot[bot]: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Bumps the kubernetes group with 2 updates in the / directory: k8s.io/apimachinery and sigs.k8s.io/e2e-framework.
Updates
k8s.io/apimachineryfrom 0.35.2 to 0.36.3Commits
40bf4b2Update dependencies to v0.36.3 tag34d46beMerge pull request #140296 from jpbetz/cherry-pick-smd-306-revert66a3724Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.32ec982dMerge pull request #139508lalitc375/automated-cherry-pick-of-#1394806a88102Fix wrong marking of errorsefb7f26Merge remote-tracking branch 'origin/master' into release-1.36d966e56Update github.com/moby/spdystream from v0.5.0 to v0.5.179b3632Merge pull request #137864 from yongruilin/dv-dra-mismatcha8822f7Add slice and map union member support with tests7dba2d0Use IsZero instead of IsNil for union ratcheting checkUpdates
k8s.io/utilsfrom 0.0.0-20251002143259-bc988d571ff4 to 0.0.0-20260210185600-b8788abfbbc2Commits
Updates
sigs.k8s.io/e2e-frameworkfrom 0.6.0 to 0.7.0Release notes
Sourced from sigs.k8s.io/e2e-framework's releases.
... (truncated)
Commits
7d89e24Merge pull request #563 from kubernetes-sigs/dependabot/github_actions/gorele...43ebb99build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.1.008a5ab3Merge pull request #561 from kubernetes-sigs/dependabot/go_modules/examples/t...27cf407build(deps): bump github.com/moby/spdystream in /examples/testcontainers2d2ccadMerge pull request #559 from kubernetes-sigs/dependabot/go_modules/examples/a...34f39d9build(deps): bump the all group in /examples with 2 updates7491cecMerge pull request #557 from chancez/pr/chancez/cluster_providers_use_ctx919f544fix: Pass Context when getting kubeconfig for cluster providersb4aba23fix: Pass context to cluster providers when creating clustersc2722ecMerge pull request #546 from faganihajizada/fix/carve-out-examples-module-540Summary by CodeRabbit