chore(deps): bump the go-dependencies group across 1 directory with 11 updates

[dependabot]

Bumps the go-dependencies group with 7 updates in the / directory:

Package	From	To
carvel.dev/kapp-controller	0.60.4	0.60.7
github.com/cert-manager/cert-manager	1.21.1	1.21.2
github.com/fluxcd/kustomize-controller/api	1.9.4	1.9.5
github.com/fluxcd/source-controller/api	1.9.4	1.9.5
github.com/shipwright-io/build	0.20.11	0.21.1
honnef.co/go/tools	0.7.0	0.8.1
sigs.k8s.io/controller-runtime	0.24.1	0.25.0

Updates carvel.dev/kapp-controller from 0.60.4 to 0.60.7

Release notes

Sourced from carvel.dev/kapp-controller's releases.

v0.60.7

Installation of kctrl

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.60.7/kctrl-linux-amd64
# Move the binary in to your PATH
mv kctrl-linux-amd64 /usr/local/bin/kctrl
# Make the binary executable
chmod +x /usr/local/bin/kctrl

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install kctrl
$ kctrl version

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate, and signature
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.60.7/checksums.txt
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.60.7/checksums.txt.pem
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.60.7/checksums.txt.sig
Verify the checksums file
cosign verify-blob checksums.txt --bundle release/checksums.json --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature. For instance, if you are using Linux on an AMD64 architecture:

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

... (truncated)

Commits

• d7a354f Merge pull request #1851 from sameerforge/topic/sameerkh/k8s-api-endpoints-test
• 6b5d772 Add TestK8APIEndpoints and run it across k8s versions on a schedule
• 35094d8 Merge pull request #1854 from himsngh/himsngh/fix-1603
• 8ac444c update reviewdog-action-misspell version
• 3c50d60 Fix[1603]: Update vendir to v0.46.2 (consumes fix for issue #1603)
• 7e3587f Merge pull request #1850 from himsngh/fix/config-reconciler-swallowed-osconfi...
• a5e732f Merge pull request #1848 from sameerforge/topic/sameerkh/bump-go
• 2d1d6a9 Propagate config reconciler errors so sidecar-not-ready races self-heal
• 98220b6 Bump go to v1.26.5 & update dependencies.yml with latest checksums
• bb9a0bc Merge pull request #1795 from carvel-dev/bump-dependencies
• Additional commits viewable in compare view

Updates github.com/cert-manager/cert-manager from 1.21.1 to 1.21.2

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.21.2

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

• ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#9239, @​FelixPhipps)
• Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#9222, @​FelixPhipps)
• De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#9234, @​speer)
• Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#9240, @​wieghx)
• Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#9235, @​lunarwhite)
• Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#9278, @​arpitjain099)
• Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#9236, @​hjoshi123)
• Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#9313, @​shashankvarma499)
• Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#9238, @​thc1006)
• Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#9312, @​shashankvarma499)
• Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#9262, @​FelixPhipps)
• Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#9314, @​KR-Ravindra)
• The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#9232, @​FelixPhipps)
• The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#9231, @​FelixPhipps)

Other (Cleanup or Flake)

• Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. (#9151, @​wallrj)
• Upgrade Go to 1.26.8. (#9323, @​wallrj)
• Bump google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities (#9255, #9317)
• Bump golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities (#9265)

Commits

• 922a06a Merge pull request #9323 from wallrj/release-1.21-go-1.26.8
• c5e1f72 Merge pull request #9326 from cert-manager/renovate/release-1.21-base-images
• e5e15f8 chore(deps): update base images
• 4c0e4d2 Merge pull request #9321 from cert-manager-bot/cherry-pick-9320-to-release-1.21
• 1d69000 Update vendored Go to 1.26.8
• 8fdd7dc Merge pull request #9317 from cert-manager/renovate/release-1.21-go-google.go...
• 37fd8f8 fix(e2e): give each SelfSigned CSR spec its own Secret
• 5badcbd certificate-shim: do not mutate the cached object's labels (#9303) (#9314)
• e4abe87 chore(deps): update module google.golang.org/grpc to v1.83.2 [security]
• 04e9f2b fix(acme): make the custom DNS server rotation counter atomic (#9273) (#9313)
• Additional commits viewable in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.9.4 to 1.9.5

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.9.5

Changelog

v1.9.5 changelog

Container images

• docker.io/fluxcd/kustomize-controller:v1.9.5
• ghcr.io/fluxcd/kustomize-controller:v1.9.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.9.5

Release date: 2026-08-31

This patch release stops the controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution: a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. In addition, the kubeconfigs read from .spec.kubeConfig Secrets are now required to be self-contained: credentials and certificates must be embedded inline (token, client-certificate-data, client-key-data, certificate-authority-data), and entries referencing files on the local filesystem are rejected. The fluxcd/pkg updates also bring Kubernetes to 1.36.4.

Fixes:

• fix: purge tmp dirs at startup #1730
• Update fluxcd/pkg dependencies #1727 #1728

Commits

• d5d5d2b Merge pull request #1732 from fluxcd/release-v1.9.5
• cf08b62 Release v1.9.5
• f5c2bce Add changelog entry for v1.9.5
• 0a95b77 Merge pull request #1730 from fluxcd/backport-1729-to-release/v1.9.x
• 49e8acd fix: purge tmp dirs at startup
• d537949 Merge pull request #1728 from fluxcd/update-pkg-deps/release/v1.9.x
• e0b4d11 Update fluxcd/pkg dependencies
• cbe2504 Merge pull request #1727 from fluxcd/update-pkg-deps/release/v1.9.x
• ab3bbb7 Update fluxcd/pkg dependencies
• See full diff in compare view

Updates github.com/fluxcd/source-controller/api from 1.9.4 to 1.9.5

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.9.5

Changelog

v1.9.5 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.5
• ghcr.io/fluxcd/source-controller:v1.9.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.9.5

Release date: 2026-08-31

This patch release upgrades Helm to v4.2.4 to stay in sync with helm-controller 1.6, which moved back from the Flux fork of Helm to upstream. It also updates the fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4.

Improvements:

• Upgrade helm to 4.2.4 (sync with HC 1.6) #2140
• Update fluxcd/pkg dependencies #2141 #2142

Commits

• 53194ad Merge pull request #2143 from fluxcd/release-v1.9.5
• 4a608b1 Release v1.9.5
• 801a3c5 Add changelog entry for v1.9.5
• 70c8429 Merge pull request #2142 from fluxcd/update-pkg-deps/release/v1.9.x
• e786718 Update fluxcd/pkg dependencies
• efab76c Merge pull request #2141 from fluxcd/update-pkg-deps/release/v1.9.x
• 91c4921 Update fluxcd/pkg dependencies
• 06b08ea Merge pull request #2140 from fluxcd/helm-4.2.4
• edcbbcf Upgrade helm to 4.2.4 (sync with HC 1.6)
• See full diff in compare view

Updates github.com/shipwright-io/build from 0.20.11 to 0.21.1

Release notes

Sourced from github.com/shipwright-io/build's releases.

Shipwright Build release v0.21.1

Release changes since v0.21.0

None. This is a rebuild of all components to address vulnerabilities in the base images and in Go libraries.

To see a list of addressed vulnerabilities, please refer to shipwright-io/build#2346

Features

Fixes

API Changes

Docs

Misc

#2337 by @​openshift-cherrypick-robot: Update golang.org/x/crypto from v0.55.0 to v0.56.0 to address CVE-2026-56855 and CVE-2026-78662

Shipwright Build release v0.21.0

Release changes since v0.20.0

Features

#2275 by @​anchi205: Shipwright now rejects a list of environment variables when creating a Build or BuildRun. The list can be customized.

#2187 by @​avinal: action required: metric changes with new metrics (build_buildrun_result_total, build_buildrun_failure_reason_total, build_buildruns_active, build_buildstrategy_count), new labels (strategy_kind, executor, result, source_type; opt-in via PROMETHEUS_ENABLED_LABELS), deprecation (build_buildruns_completed_total in favor of build_buildrun_result_total), changes (build_builds_registered_total now counts both successful and failed registrations)

Fixes

#2305 by @​Ryntak94: Fixed BuildRun conversion silently dropping .spec.output.insecure and .spec.output.timestamp. Both fields are now preserved when a BuildRun is converted between v1alpha1 and v1beta1, matching the existing Build conversion behaviour.

#2292 by @​SaschaSchwarze0: You can no longer create Builds and BuildRuns that have an empty annotation or label key for the output object. Also, keys are validated to not contain the = character which is actually a limitation Shipwright enforces due to how it handles this data in its processing.

#2252 by @​kaizakin: SetOwnerReferenceFailed updates buildrun status instead of build and stops reconciliation instead of continuing to build

API Changes

Docs

Misc

#2314 by @​SaschaSchwarze0: Kubernetes 1.37 is now supported

#2313 by @​shipwright-ci-bot: Update to the new latest Tekton LTS release v1.15.1

#2302 by @​IrvingMg: The buildpacks-v3 sample build strategies now pin the Paketo builder image to a specific tag instead of using the floating latest tag.

#2294 by @​SaschaSchwarze0: The minimum supported Tekton version is now v1.6

... (truncated)

Commits

• 20f3ec4 Merge pull request #2337 from openshift-cherrypick-robot/cherry-pick-2335-to-...
• 0626b95 Update golang.org/x/crypto from v0.55.0 to v0.56.0 to address CVE-2026-56855 ...
• 31e4deb Merge pull request #2320 from shipwright-io/update-readme-tag-refs
• c40e6ed Update Readme with new Tag v0.21.0
• dc2b7c6 Merge pull request #2319 from shipwright-io/docker.io/paketobuildpacks/builde...
• 45c4707 Bump docker.io/paketobuildpacks/builder-jammy-full from 0.3.652 to 0.3.655
• 09d60bf Merge pull request #2317 from shipwright-io/docker.io/paketobuildpacks/builde...
• 052d64f Merge pull request #2318 from shipwright-io/dependabot/go_modules/github.com/...
• 5a9fa99 build(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3
• 97a8dba Bump docker.io/paketobuildpacks/builder-jammy-full from 0.3.650 to 0.3.652
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.55.0 to 0.56.0

Commits

• 86efde5 ssh: reject unexpected message types on established channels
• a6cdac6 ssh: drop traffic on undecided channels
• 39dc44e ssh: don't skip the source-address critical option in CheckCert
• afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
• 89f4e9b x509roots/fallback: update bundle
• 71488c4 ssh/knownhosts: compare only public key portions for revocation
• 82adefa ssh: synchronize unexpected response test
• c757c98 all: upgrade go directive to at least 1.26.0 [generated]
• 593c81a ssh: correctly ignore pre-banner lines
• 46efc8b acme: add crypto.SignMessage test coverage
• Additional commits viewable in compare view

Updates honnef.co/go/tools from 0.7.0 to 0.8.1

Commits

• 1285a6a Version 2026.2.1 (v0.8.1)
• 41fe1c7 website: add 2026.2.1 release notes
• 5bb0735 SA4023: only flag possibly typed nils
• 8d63ae3 go/types/typeutil: rename IsPointerLike to MaybePointerLike
• f01b3d2 go/types/typesutil: return true from IsPointerLike for unconstrained type sets
• f0c0ad6 Version 2026.2 (v0.8.0)
• 0a6410f website: update shell.nix
• 81d37dd website: finalize 2026.2 release notes
• f4f8a57 analysis/facts/nilness: handle 'recover' builtin
• c6603d6 go/ir: fix use of GO111MODULE in tests
• Additional commits viewable in compare view

Updates k8s.io/api from 0.36.3 to 0.36.4

Commits

• 9a6751a Update dependencies to v0.36.4 tag
• 82d8177 Merge pull request #141226 from liggitt/golang-deps-1-36
• a3de3f4 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.3 to 0.36.4

Commits

• 612c0ec Update dependencies to v0.36.4 tag
• 5af8c14 Merge pull request #141226 from liggitt/golang-deps-1-36
• 42e032e Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/client-go from 0.36.3 to 0.36.4

Commits

• 4e24acf Update dependencies to v0.36.4 tag
• a92355f Merge pull request #141226 from liggitt/golang-deps-1-36
• e8e8834 Update golang.org/x deps
• 736cbae Merge pull request #141001 from alancaldelas/automated-cherry-pick-of-#140966...
• f4108cd client-go: restore FakeCustomStore conformance to cache.Store
• See full diff in compare view

Updates sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.25.0

Highlights

This version of controller-runtime introduces a new experimental ReadYourWritesConsistency feature, which ensures that all writes are reflected in subsequent reads from the default cache-backed client. Stale client reads are arguably the biggest source of friction and sometimes bugs for controller authors, providing this functionality at the library level eliminates that class of problems entirely.

Try it out by setting Client.EnableReadYourWritesConsistency: new(true) in your manager and leave any feedback you may have on the tracking issue.

⚠️ Breaking Changes

• Dependencies: Bump to k8s.io/* v1.37 (#3579 #3575 #3567 #3561 #3547 #3529 #3524)
• Events: Add new EventRecorder interface (#3509)

✨ New Features

• Client: Add a read-your-own-writes client (#3472)
• Fakeclient: Add WithGlobalResourceVersionCounter (#3581)
• Fakeclient: Add scale subresource support for Apply (#3569)
• Metrics: Allow opt-in for client-go REST client metrics (#3510)
• Metrics: Allow overriding client-go REST client metrics latency histogram buckets (#3573)
• Source: Add TypedInformer source (#3520)
• Webhooks: Allow to disable the webhook server by setting the port to -1 (#3481)

🐛 Bug Fixes

• Cache: Fix goroutine leaks in cache Start() methods (#3565)
• Client: Fix regression in Apply typed error handling (#3515)
• Controller: Unlock when Controller.Start() returns with error (#3545)
• Envtest: Fix envtest process stop on Windows (#3519)
• Fakeclient: Allow updating managedFields through Update (#3585)
• Fakeclient: Fix AddIndex panic when wrapped with an interceptor (#3583)
• Fakeclient: Fix PartialObjectMeta handling (#3571)
• Fakeclient: Support scale subresource get/update for unstructured objects (#3546)
• Fakeclient: Update object on subresource apply (#3570)
• PriorityQueue: Fix PriorityQueue deadlock on shutdown (#3540)
• Testing/Process: Fix process Stop timeout error handling (#3523)

🌱 Others

• LeaderElection: Pass Managers Logger to Leader Elector via Context (#3576)

🌱 CI & linters

• Add copyright header validation & fix findings (#3544)
• Bump to golangci-lint v2.12.1 (#3514)
• Bump to golangci-lint v2.12.2 (#3532)
• Bump to golangci-lint v2.13.1 (#3580)

... (truncated)

Commits

• e8f9455 🐛 fakeclient: Allow updating managedFields through Update (#3585)
• 0cc1315 Merge pull request #3565 from dongjiang1989/fix-leak
• fa96780 🐛 Fix goroutine leaks in cache Start() methods
• 1f5514b ✨ Add a read-your-own-write client (#3472)
• df386c7 🌱 Bump to golangci-lint v2.13.1 (#3580)
• dc7618f Merge pull request #3583 from pujitha24/auto/issue-3582
• 37fe235 🐛 fake: fix AddIndex panic when client is wrapped with an interceptor
• 01c7782 ✨ Allow overriding REST client latency histogram buckets (#3573)
• 857be80 Merge pull request #3576 from demirdilek/fix-leaderelection-contextual-logging
• b1387be Merge pull request #3581 from alvaroaleman/fake-consistent
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.