chore(deps): bump the go-dependencies group across 1 directory with 12 updates

[dependabot]

Bumps the go-dependencies group with 12 updates in the / directory:

Package	From	To
carvel.dev/kapp-controller	0.60.4	0.60.8
github.com/cert-manager/cert-manager	1.21.1	1.21.2
github.com/fluxcd/kustomize-controller/api	1.9.4	1.9.5
github.com/fluxcd/pkg/apis/meta	1.31.0	1.32.0
github.com/fluxcd/source-controller/api	1.9.4	1.9.5
github.com/shipwright-io/build	0.20.11	0.21.4
golang.org/x/crypto	0.55.0	0.56.0
honnef.co/go/tools	0.7.0	0.8.1
k8s.io/api	0.36.3	0.36.4
k8s.io/apimachinery	0.36.3	0.37.0
k8s.io/client-go	0.36.3	0.36.4
sigs.k8s.io/controller-runtime	0.24.1	0.25.1

Updates carvel.dev/kapp-controller from 0.60.4 to 0.60.8

Release notes

Sourced from carvel.dev/kapp-controller's releases.

v0.60.8

Installation of kctrl

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.60.8/kctrl-linux-amd64
# Move the binary in to your PATH
mv kctrl-linux-amd64 /usr/local/bin/kctrl
# Make the binary executable
chmod +x /usr/local/bin/kctrl

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install kctrl
$ kctrl version

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate, and signature
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.60.8/checksums.txt
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.60.8/checksums.txt.pem
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.60.8/checksums.txt.sig
Verify the checksums file
cosign verify-blob checksums.txt --bundle release/checksums.json --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature. For instance, if you are using Linux on an AMD64 architecture:

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

... (truncated)

Commits

• d84c87e Merge pull request #1856 from chappjc/jon/ssa-fix
• 820315c Merge branch 'develop' into jon/ssa-fix
• 5ce6525 Merge pull request #1857 from himsngh/himsngh/fix-precommit-workflows-contain...
• 06f5172 ci: force minikube to use docker runtime to fix buildx 404 errors
• d2c1d72 implement OpenAPIModelName to fix SSA of data.packaging.carvel.dev types
• d7a354f Merge pull request #1851 from sameerforge/topic/sameerkh/k8s-api-endpoints-test
• 6b5d772 Add TestK8APIEndpoints and run it across k8s versions on a schedule
• 35094d8 Merge pull request #1854 from himsngh/himsngh/fix-1603
• 8ac444c update reviewdog-action-misspell version
• 3c50d60 Fix[1603]: Update vendir to v0.46.2 (consumes fix for issue #1603)
• Additional commits viewable in compare view

Updates github.com/cert-manager/cert-manager from 1.21.1 to 1.21.2

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.21.2

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

• ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#9239, @​FelixPhipps)
• Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#9222, @​FelixPhipps)
• De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#9234, @​speer)
• Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#9240, @​wieghx)
• Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#9235, @​lunarwhite)
• Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#9278, @​arpitjain099)
• Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#9236, @​hjoshi123)
• Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#9313, @​shashankvarma499)
• Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#9238, @​thc1006)
• Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#9312, @​shashankvarma499)
• Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#9262, @​FelixPhipps)
• Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#9314, @​KR-Ravindra)
• The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#9232, @​FelixPhipps)
• The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#9231, @​FelixPhipps)

Other (Cleanup or Flake)

• Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. (#9151, @​wallrj)
• Upgrade Go to 1.26.8. (#9323, @​wallrj)
• Bump google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities (#9255, #9317)
• Bump golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities (#9265)

Commits

• 922a06a Merge pull request #9323 from wallrj/release-1.21-go-1.26.8
• c5e1f72 Merge pull request #9326 from cert-manager/renovate/release-1.21-base-images
• e5e15f8 chore(deps): update base images
• 4c0e4d2 Merge pull request #9321 from cert-manager-bot/cherry-pick-9320-to-release-1.21
• 1d69000 Update vendored Go to 1.26.8
• 8fdd7dc Merge pull request #9317 from cert-manager/renovate/release-1.21-go-google.go...
• 37fd8f8 fix(e2e): give each SelfSigned CSR spec its own Secret
• 5badcbd certificate-shim: do not mutate the cached object's labels (#9303) (#9314)
• e4abe87 chore(deps): update module google.golang.org/grpc to v1.83.2 [security]
• 04e9f2b fix(acme): make the custom DNS server rotation counter atomic (#9273) (#9313)
• Additional commits viewable in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.9.4 to 1.9.5

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.9.5

Changelog

v1.9.5 changelog

Container images

• docker.io/fluxcd/kustomize-controller:v1.9.5
• ghcr.io/fluxcd/kustomize-controller:v1.9.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.9.5

Release date: 2026-08-31

This patch release stops the controller from leaving behind the temporary directories of a previous process that exited without running its cleanup, and fixes a crash in post-build substitution: a substring expression with a negative length, e.g. ${VAR:2:-1}, panicked instead of counting back from the end of the string like Bash does. In addition, the kubeconfigs read from .spec.kubeConfig Secrets are now required to be self-contained: credentials and certificates must be embedded inline (token, client-certificate-data, client-key-data, certificate-authority-data), and entries referencing files on the local filesystem are rejected. The fluxcd/pkg updates also bring Kubernetes to 1.36.4.

Fixes:

• fix: purge tmp dirs at startup #1730
• Update fluxcd/pkg dependencies #1727 #1728

Commits

• d5d5d2b Merge pull request #1732 from fluxcd/release-v1.9.5
• cf08b62 Release v1.9.5
• f5c2bce Add changelog entry for v1.9.5
• 0a95b77 Merge pull request #1730 from fluxcd/backport-1729-to-release/v1.9.x
• 49e8acd fix: purge tmp dirs at startup
• d537949 Merge pull request #1728 from fluxcd/update-pkg-deps/release/v1.9.x
• e0b4d11 Update fluxcd/pkg dependencies
• cbe2504 Merge pull request #1727 from fluxcd/update-pkg-deps/release/v1.9.x
• ab3bbb7 Update fluxcd/pkg dependencies
• See full diff in compare view

Updates github.com/fluxcd/pkg/apis/meta from 1.31.0 to 1.32.0

Commits

• fc29ca0 Merge pull request #1293 from fluxcd/release-main
• 98725a2 Prepare for release
• 1e50081 Merge pull request #1144 from adri1197/event-api
• 46f413f Migrate event recorder to events/v1 API
• 46433b8 Merge pull request #1298 from dipti-pai/kustomize-substitute-with-vars
• 56fb7e5 kustomize: add ContextWithSecretVarsCollector for LoadVariables
• 6d8d5d9 Merge pull request #1292 from fluxcd/k8s-1.37.0
• a532207 auth: Update cloud SDKs
• bc7fd2f Update to Kubernetes 1.37.0
• c437e4f Merge pull request #1290 from fluxcd/comment-migrate-api-version
• Additional commits viewable in compare view

Updates github.com/fluxcd/source-controller/api from 1.9.4 to 1.9.5

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.9.5

Changelog

v1.9.5 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.5
• ghcr.io/fluxcd/source-controller:v1.9.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.9.5

Release date: 2026-08-31

This patch release upgrades Helm to v4.2.4 to stay in sync with helm-controller 1.6, which moved back from the Flux fork of Helm to upstream. It also updates the fluxcd/pkg dependencies, which bring Kubernetes to 1.36.4.

Improvements:

• Upgrade helm to 4.2.4 (sync with HC 1.6) #2140
• Update fluxcd/pkg dependencies #2141 #2142

Commits

• 53194ad Merge pull request #2143 from fluxcd/release-v1.9.5
• 4a608b1 Release v1.9.5
• 801a3c5 Add changelog entry for v1.9.5
• 70c8429 Merge pull request #2142 from fluxcd/update-pkg-deps/release/v1.9.x
• e786718 Update fluxcd/pkg dependencies
• efab76c Merge pull request #2141 from fluxcd/update-pkg-deps/release/v1.9.x
• 91c4921 Update fluxcd/pkg dependencies
• 06b08ea Merge pull request #2140 from fluxcd/helm-4.2.4
• edcbbcf Upgrade helm to 4.2.4 (sync with HC 1.6)
• See full diff in compare view

Updates github.com/shipwright-io/build from 0.20.11 to 0.21.4

Release notes

Sourced from github.com/shipwright-io/build's releases.

Shipwright Build release v0.21.4

Release changes since v0.21.3

None. This is a rebuild of all components to address vulnerabilities in the base images.

To see a list of addressed vulnerabilities, please refer to shipwright-io/build#2363

Features

Fixes

API Changes

Docs

Misc

Shipwright Build release v0.21.3

Release changes since v0.21.2

None. This is a rebuild of all components to address vulnerabilities in the base images.

To see a list of addressed vulnerabilities, please refer to shipwright-io/build#2355

Features

Fixes

API Changes

Docs

Misc

Shipwright Build release v0.21.2

Release changes since v0.21.1

None. This is a rebuild of all components to address vulnerabilities in the base images.

To see a list of addressed vulnerabilities, please refer to shipwright-io/build#2346

Features

Fixes

API Changes

Docs

Misc

... (truncated)

Commits

• 6dec39b Merge pull request #2356 from shipwright-io/update-readme-tag-refs
• 2a3033f Update Readme with new Tag v0.21.3
• 1dc2436 Merge pull request #2351 from shipwright-io/update-readme-tag-refs
• 21f5198 Update Readme with new Tag v0.21.2
• 01f36fd Merge pull request #2348 from shipwright-io/update-readme-tag-refs
• feddd8c Update Readme with new Tag v0.21.1
• 20f3ec4 Merge pull request #2337 from openshift-cherrypick-robot/cherry-pick-2335-to-...
• 0626b95 Update golang.org/x/crypto from v0.55.0 to v0.56.0 to address CVE-2026-56855 ...
• 31e4deb Merge pull request #2320 from shipwright-io/update-readme-tag-refs
• c40e6ed Update Readme with new Tag v0.21.0
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.55.0 to 0.56.0

Commits

• 86efde5 ssh: reject unexpected message types on established channels
• a6cdac6 ssh: drop traffic on undecided channels
• 39dc44e ssh: don't skip the source-address critical option in CheckCert
• afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
• 89f4e9b x509roots/fallback: update bundle
• 71488c4 ssh/knownhosts: compare only public key portions for revocation
• 82adefa ssh: synchronize unexpected response test
• c757c98 all: upgrade go directive to at least 1.26.0 [generated]
• 593c81a ssh: correctly ignore pre-banner lines
• 46efc8b acme: add crypto.SignMessage test coverage
• Additional commits viewable in compare view

Updates honnef.co/go/tools from 0.7.0 to 0.8.1

Commits

• 1285a6a Version 2026.2.1 (v0.8.1)
• 41fe1c7 website: add 2026.2.1 release notes
• 5bb0735 SA4023: only flag possibly typed nils
• 8d63ae3 go/types/typeutil: rename IsPointerLike to MaybePointerLike
• f01b3d2 go/types/typesutil: return true from IsPointerLike for unconstrained type sets
• f0c0ad6 Version 2026.2 (v0.8.0)
• 0a6410f website: update shell.nix
• 81d37dd website: finalize 2026.2 release notes
• f4f8a57 analysis/facts/nilness: handle 'recover' builtin
• c6603d6 go/ir: fix use of GO111MODULE in tests
• Additional commits viewable in compare view

Updates k8s.io/api from 0.36.3 to 0.36.4

Commits

• 9a6751a Update dependencies to v0.36.4 tag
• 82d8177 Merge pull request #141226 from liggitt/golang-deps-1-36
• a3de3f4 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.3 to 0.37.0

Commits

• 7164e39 Update dependencies to v0.37.0 tag
• e55f9ba feat(api): Update node restriction admission to use new API
• cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis
• 97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api
• f21afab Add validation for camelcase in reason field
• d7ad413 Merge pull request #140782 from dims/update-kube-openapi
• e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist
• 464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
• 0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key
• 95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...
• Additional commits viewable in compare view

Updates k8s.io/client-go from 0.36.3 to 0.36.4

Commits

• 4e24acf Update dependencies to v0.36.4 tag
• a92355f Merge pull request #141226 from liggitt/golang-deps-1-36
• e8e8834 Update golang.org/x deps
• 736cbae Merge pull request #141001 from alancaldelas/automated-cherry-pick-of-#140966...
• f4108cd client-go: restore FakeCustomStore conformance to cache.Store
• See full diff in compare view

Updates sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.1

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.25.1

What's Changed

• 🐛 priorityqueue: fix data race on []*item in logState by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3593
• 🐛 client: fix subresource create RV parse error under read-your-writes consistency by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3596

Full Changelog: kubernetes-sigs/controller-runtime@v0.25.0...v0.25.1

v0.25.0

Highlights

This version of controller-runtime introduces a new experimental ReadYourWritesConsistency feature, which ensures that all writes are reflected in subsequent reads from the default cache-backed client. Stale client reads are arguably the biggest source of friction and sometimes bugs for controller authors, providing this functionality at the library level eliminates that class of problems entirely.

Try it out by setting Client.EnableReadYourWritesConsistency: new(true) in your manager and leave any feedback you may have on the tracking issue.

⚠️ Breaking Changes

• Dependencies: Bump to k8s.io/* v1.37 (#3579 #3575 #3567 #3561 #3547 #3529 #3524)
• Events: Add new EventRecorder interface (#3509)

✨ New Features

• Client: Add a read-your-own-writes client (#3472)
• Fakeclient: Add WithGlobalResourceVersionCounter (#3581)
• Fakeclient: Add scale subresource support for Apply (#3569)
• Metrics: Allow opt-in for client-go REST client metrics (#3510)
• Metrics: Allow overriding client-go REST client metrics latency histogram buckets (#3573)
• Source: Add TypedInformer source (#3520)
• Webhooks: Allow to disable the webhook server by setting the port to -1 (#3481)

🐛 Bug Fixes

• Cache: Fix goroutine leaks in cache Start() methods (#3565)
• Client: Fix regression in Apply typed error handling (#3515)
• Controller: Unlock when Controller.Start() returns with error (#3545)
• Envtest: Fix envtest process stop on Windows (#3519)
• Fakeclient: Allow updating managedFields through Update (#3585)
• Fakeclient: Fix AddIndex panic when wrapped with an interceptor (#3583)
• Fakeclient: Fix PartialObjectMeta handling (#3571)
• Fakeclient: Support scale subresource get/update for unstructured objects (#3546)
• Fakeclient: Update object on subresource apply (#3570)
• PriorityQueue: Fix PriorityQueue deadlock on shutdown (#3540)
• Testing/Process: Fix process Stop timeout error handling (#3523)

🌱 Others

... (truncated)

Commits

• 67b72c2 [release-0.25] 🐛 client: fix subresource create RV parse error under read-you...
• f997220 [release-0.25] 🐛 priorityqueue: fix data race on []*item in logState (#3593)
• e8f9455 🐛 fakeclient: Allow updating managedFields through Update (#3585)
• 0cc1315 Merge pull request #3565 from dongjiang1989/fix-leak
• fa96780 🐛 Fix goroutine leaks in cache Start() methods
• 1f5514b ✨ Add a read-your-own-write client (#3472)
• df386c7 🌱 Bump to golangci-lint v2.13.1 (#3580)
• dc7618f Merge pull request #3583 from pujitha24/auto/issue-3582
• 37fe235 🐛 fake: fix AddIndex panic when client is wrapped with an interceptor
• 01c7782 ✨ Allow overriding REST client latency histogram buckets (#3573)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions