Skip to content

fix(deps): update all minor and patch - #409

Merged
markussiebert merged 2 commits into
masterfrom
renovate/all-minor-and-patch
Sep 30, 2026
Merged

markussiebert merged 2 commits into
masterfrom
renovate/all-minor-and-patch

Conversation

@renovate

@renovate renovate Bot commented Sep 4, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Age Confidence
codecov/codecov-action action minor v7.0.0 → v7.1.1 age confidence
docker/setup-buildx-action action minor v4.3.0 → v4.4.1 age confidence
docker/setup-qemu-action action minor v4.3.0 → v4.4.0 age confidence
github.com/crossplane/crossplane-runtime/v2 require patch v2.4.0 → v2.4.2 age confidence
github.com/crossplane/crossplane/apis/v2 require patch v2.4.0 → v2.4.2 age confidence
gitlab.com/gitlab-org/api/client-go/v2 require minor v2.62.0 → v2.64.0 age confidence
golang.org/x/oauth2 require minor v0.36.0 → v0.37.0 age confidence
golang.org/x/sync require minor v0.22.0 → v0.23.0 age confidence
jlumbroso/free-disk-space action patch v1.3.1 → v1.3.2 age confidence
k8s.io/api require patch v0.37.0 → v0.37.1 age confidence
k8s.io/apiextensions-apiserver require patch v0.37.0 → v0.37.1 age confidence
k8s.io/apimachinery require patch v0.37.0 → v0.37.1 age confidence
k8s.io/client-go require patch v0.37.0 → v0.37.1 age confidence
sigs.k8s.io/controller-runtime require minor v0.24.1 → v0.25.1 age confidence
zeebe-io/backport-action action minor v4.6.0 → v4.7.0 age confidence

Release Notes

codecov/codecov-action (codecov/codecov-action)

v7.1.1

Compare Source

v7.1.0

Compare Source

docker/setup-buildx-action (docker/setup-buildx-action)

v4.4.1

Compare Source

v4.4.0

Compare Source

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

docker/setup-qemu-action (docker/setup-qemu-action)

v4.4.0

Compare Source

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

crossplane/crossplane-runtime (github.com/crossplane/crossplane-runtime/v2)

v2.4.2

Compare Source

What's Changed

Full Changelog: crossplane/crossplane-runtime@v2.4.0...v2.4.2

crossplane/crossplane (github.com/crossplane/crossplane/apis/v2)

v2.4.2

Compare Source

v2.4.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights
  • Fixed a bug where ownership of ServiceAccounts was not correctly transferred to newly active package revisions (#​7838). Fixed in #​7839 and backported in #​7852.
What's Changed

Full Changelog: crossplane/crossplane@v2.4.1...v2.4.2

v2.4.1

Compare Source

v2.4.1 is a patch release scoped to fixing issues reported by users of Crossplane v2.4 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

  • Package revisions now take control of established objects from the revision they replace: An outgoing package revision could fail to relinquish control of the package's CRDs, leaving the incoming revision permanently unhealthy with cannot establish control of object. The provider's pod would never be created, so that provider could do no work without manual intervention by someone either deleting the stale revision or editing the CRD's owner reference by hand. Package revisions now directly take control from the revision they replace, so the hand-off succeeds without any intervention. Backported in #​7821, originally fixed in #​7733.
  • Dependency security updates: Bumps the Go toolchain to 1.26.7 (#​7803), google.golang.org/grpc to v1.83.2 (#​7800, #​7826), and golang.org/x/crypto to v0.56.0 (#​7810) to pick up upstream CVE fixes — including the gRPC advisory GHSA-2v4p-qf9q-27wj. Also bumps github.com/crossplane/crossplane/apis/v2 to v2.4.0 (#​7780) and refreshes the lock file (#​7779).

What's Changed

Full Changelog: crossplane/crossplane@v2.4.0...v2.4.1

gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go/v2)

v2.64.0

Compare Source

2.64.0
🚀 Features
🔄 Other Changes
2.64.0 (2026-09-05)
Features
  • support achievements CRUD operations (c292954)

v2.63.0

Compare Source

2.63.0
🚀 Features
🔄 Other Changes
2.63.0 (2026-09-04)
Features
  • add an API route registry with Routes and MatchRoute (ba606c7)
jlumbroso/free-disk-space (jlumbroso/free-disk-space)

v1.3.2: — security fix and the decision records

Compare Source

Fixes the template-injection pattern in input handling (#​51, by @​nbuckwalt).

Also adds docs/adr/ — the reasoning behind this action: why it exists, what it inherited from apache/flink and ShubhamTatvamasi, what it deliberately does not do, and what is still open.

No behaviour changes. The swap-storage default change ships in the next release.

kubernetes/api (k8s.io/api)

v0.37.1

Compare Source

kubernetes/apiextensions-apiserver (k8s.io/apiextensions-apiserver)

v0.37.1

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

v0.37.1

Compare Source

kubernetes/client-go (k8s.io/client-go)

v0.37.1

Compare Source

kubernetes-sigs/controller-runtime (sigs.k8s.io/controller-runtime)

v0.25.1

Compare Source

What's Changed

Full Changelog: kubernetes-sigs/controller-runtime@v0.25.0...v0.25.1

v0.25.0

Compare Source

Highlights

This version of controller-runtime introduces a new experimental ReadYourWritesConsistency feature,
which ensures that all writes are reflected in subsequent reads from the default cache-backed client.
Stale client reads are arguably the biggest source of friction and sometimes bugs for controller
authors, providing this functionality at the library level eliminates that class of problems entirely.

Try it out by setting Client.EnableReadYourWritesConsistency: new(true) in your manager
and leave any feedback you may have on the tracking issue.

⚠️ Breaking Changes

✨ New Features

  • Client: Add a read-your-own-writes client (#​3472)
  • Fakeclient: Add WithGlobalResourceVersionCounter (#​3581)
  • Fakeclient: Add scale subresource support for Apply (#​3569)
  • Metrics: Allow opt-in for client-go REST client metrics (#​3510)
  • Metrics: Allow overriding client-go REST client metrics latency histogram buckets (#​3573)
  • Source: Add TypedInformer source (#​3520)
  • Webhooks: Allow to disable the webhook server by setting the port to -1 (#​3481)

🐛 Bug Fixes

  • Cache: Fix goroutine leaks in cache Start() methods (#​3565)
  • Client: Fix regression in Apply typed error handling (#​3515)
  • Controller: Unlock when Controller.Start() returns with error (#​3545)
  • Envtest: Fix envtest process stop on Windows (#​3519)
  • Fakeclient: Allow updating managedFields through Update (#​3585)
  • Fakeclient: Fix AddIndex panic when wrapped with an interceptor (#​3583)
  • Fakeclient: Fix PartialObjectMeta handling (#​3571)
  • Fakeclient: Support scale subresource get/update for unstructured objects (#​3546)
  • Fakeclient: Update object on subresource apply (#​3570)
  • PriorityQueue: Fix PriorityQueue deadlock on shutdown (#​3540)
  • Testing/Process: Fix process Stop timeout error handling (#​3523)

🌱 Others

  • LeaderElection: Pass Managers Logger to Leader Elector via Context (#​3576)

🌱 CI & linters

  • Add copyright header validation & fix findings (#​3544)
  • Bump to golangci-lint v2.12.1 (#​3514)
  • Bump to golangci-lint v2.12.2 (#​3532)
  • Bump to golangci-lint v2.13.1 (#​3580)
  • Declare contents: read permissions for pr-verify action (#​3517)
  • Revert "Migrate away from custom GitHub action approval workflow" (#​3528)

📖 Additionally, there have been 7 contributions to our documentation and book. (#​3513, #​3521, #​3531, #​3551, #​3562, #​3563, #​3566)

Dependencies

Added
  • github.com/go-openapi/swag/cmdutils: v0.27.1
  • github.com/go-openapi/swag/conv: v0.27.1
  • github.com/go-openapi/swag/fileutils: v0.27.1
  • github.com/go-openapi/swag/jsonutils/fixtures_test: v0.27.1
  • github.com/go-openapi/swag/jsonutils: v0.27.1
  • github.com/go-openapi/swag/loading: v0.27.1
  • github.com/go-openapi/swag/mangling: v0.27.1
  • github.com/go-openapi/swag/netutils: v0.27.1
  • github.com/go-openapi/swag/pools: v0.27.1
  • github.com/go-openapi/swag/stringutils: v0.27.1
  • github.com/go-openapi/swag/typeutils: v0.27.1
  • github.com/go-openapi/swag/yamlutils: v0.27.1
  • github.com/go-openapi/testify/enable/yaml/v2: v2.6.0
  • github.com/go-openapi/testify/v2: v2.6.0
Changed
  • github.com/Azure/go-ansiterm: 306776e → faa5f7b
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.30.0 → v1.32.0
  • github.com/antlr4-go/antlr/v4: v4.13.0 → v4.13.1
  • github.com/cncf/xds/go: ee656c7 → dba9d58
  • github.com/envoyproxy/go-control-plane/envoy: v1.36.0 → v1.37.0
  • github.com/envoyproxy/protoc-gen-validate: v1.3.0 → v1.3.3
  • github.com/fxamacker/cbor/v2: v2.9.0 → v2.9.1
  • github.com/go-jose/go-jose/v4: v4.1.3 → v4.1.4
  • github.com/go-openapi/jsonpointer: v0.21.0 → v1.0.0
  • github.com/go-openapi/jsonreference: v0.20.2 → v1.0.0
  • github.com/go-openapi/swag: v0.23.0 → v0.27.1
  • github.com/golang-jwt/jwt/v5: v5.3.0 → v5.3.1
  • github.com/google/cel-go: v0.26.0 → v0.29.2
  • github.com/grpc-ecosystem/grpc-gateway/v2: v2.27.7 → v2.29.0
  • github.com/klauspost/compress: v1.18.0 → v1.19.0
  • github.com/moby/term: v0.5.0 → v0.5.2
  • github.com/prometheus/client_golang: v1.23.2 → v1.24.0
  • github.com/prometheus/common: v0.67.5 → v0.70.0
  • github.com/prometheus/procfs: v0.19.2 → v0.21.1
  • github.com/sirupsen/logrus: v1.9.3 → v1.9.4
  • github.com/spf13/pflag: v1.0.9 → v1.0.10
  • github.com/stretchr/objx: v0.5.2 → v0.5.3
  • go.etcd.io/bbolt: v1.4.3 → v1.5.0
  • go.etcd.io/etcd/api/v3: v3.6.8 → v3.7.0
  • go.etcd.io/etcd/client/pkg/v3: v3.6.8 → v3.7.0
  • go.etcd.io/etcd/client/v3: v3.6.8 → v3.7.0
  • go.etcd.io/etcd/pkg/v3: v3.6.8 → v3.7.0
  • go.etcd.io/etcd/server/v3: v3.6.8 → v3.7.0
  • go.etcd.io/raft/v3: v3.6.0 → v3.7.0
  • go.opentelemetry.io/contrib/detectors/gcp: v1.39.0 → v1.43.0
  • go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: v0.65.0 → v0.68.0
  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.65.0 → v0.69.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.40.0 → v1.44.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.40.0 → v1.44.0
  • go.opentelemetry.io/otel/metric: v1.41.0 → v1.44.0
  • go.opentelemetry.io/otel/sdk/metric: v1.40.0 → v1.44.0
  • go.opentelemetry.io/otel/sdk: v1.40.0 → v1.44.0
  • go.opentelemetry.io/otel/trace: v1.41.0 → v1.44.0
  • go.opentelemetry.io/otel: v1.41.0 → v1.44.0
  • go.opentelemetry.io/proto/otlp: v1.9.0 → v1.10.0
  • go.yaml.in/yaml/v2: v2.4.3 → v2.4.4
  • golang.org/x/crypto: v0.47.0 → v0.54.0
  • golang.org/x/exp: 944ab1f → 746e56f
  • golang.org/x/mod: v0.32.0 → v0.37.0
  • golang.org/x/net: v0.49.0 → v0.57.0
  • golang.org/x/oauth2: v0.34.0 → v0.36.0
  • golang.org/x/sync: v0.19.0 → v0.22.0
  • golang.org/x/sys: v0.40.0 → v0.47.0
  • golang.org/x/telemetry: bd525da → 59b4966
  • golang.org/x/term: v0.39.0 → v0.45.0
  • golang.org/x/text: v0.33.0 → v0.40.0
  • golang.org/x/time: v0.14.0 → v0.15.0
  • golang.org/x/tools: v0.41.0 → v0.47.0
  • gonum.org/v1/gonum: v0.16.0 → v0.17.0
  • google.golang.org/genproto/googleapis/api: 8636f87 → 3dc84a4
  • google.golang.org/genproto/googleapis/rpc: 8636f87 → 3dc84a4
  • google.golang.org/grpc: v1.79.3 → v1.82.1
  • k8s.io/api: v0.36.0 → v0.37.0
  • k8s.io/apiextensions-apiserver: v0.36.0 → v0.37.0
  • k8s.io/apimachinery: v0.36.0 → v0.37.0
  • k8s.io/apiserver: v0.36.0 → v0.37.0
  • k8s.io/client-go: v0.36.0 → v0.37.0
  • k8s.io/code-generator: v0.36.0 → v0.37.0
  • k8s.io/component-base: v0.36.0 → v0.37.0
  • k8s.io/gengo/v2: ec3ebc5 → 25e2208
  • k8s.io/kms: v0.36.0 → v0.37.0
  • k8s.io/kube-openapi: 43fb72c → d427ff9
  • k8s.io/streaming: v0.36.0 → v0.37.0
  • k8s.io/utils: b8788ab → be93311
  • sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.34.0 → v0.36.0
  • sigs.k8s.io/structured-merge-diff/v6: v6.3.2 → v6.4.2
Removed
  • github.com/creack/pty: v1.1.9
  • github.com/gogo/protobuf: v1.3.2
  • github.com/josharian/intern: v1.0.0
  • github.com/kr/pty: v1.1.1
  • github.com/mailru/easyjson: v0.7.7
  • github.com/matttproud/golang_protobuf_extensions: v1.0.1
  • github.com/stoewer/go-strcase: v1.3.0

Thanks to all our contributors! 😊

zeebe-io/backport-action (zeebe-io/backport-action)

v4.7.0: Backport-action v4.7.0

Compare Source

What's Changed

Thanks to a great contribution by @​lexfrei, backports no longer fail when the target branch already contains some of the changes, for example if a specific commit was already manually cherry-picked, or on a re-run. Previously, git reported the empty cherry-pick as a conflict, so the backport failed (or opened a draft PR with conflict_resolution: draft_commit_conflicts).

Now the action skips those commits:

  • Some commits already on the target: the backport PR is created as usual. The comment on the original pull request mentions the skipped commits, and a comment on the backport PR lists them.
  • All commits already on the target: there's nothing to backport, so no PR is created. The target is skipped, just like when its backport PR already exists, and doesn't count as a failure in was_successful.

With comment_style: summary, that looks like this:

Target Status
stable/8.7 ✅ Created #​612 — 1 commit skipped (target already contains changes)
stable/8.6 ➖ Skipped (target already contains changes)

No configuration needed to enable this. This is a bug fix released in a new minor version to avoid surprising users with new behavior.

New Contributors
Updated dependencies

Full Changelog: korthout/backport-action@v4.6.1...v4.7.0

v4.6.1: Backport-action v4.6.1

Compare Source

What's Changed

Dependency updates only.

Updated dependencies
Maintenance changes

Full Changelog: korthout/backport-action@v4.6.0...v4.6.1


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-and-patch branch from 47479b3 to 8f91a1a Compare September 5, 2026 18:20
@renovate renovate Bot changed the title fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.0 fix(deps): update all minor and patch Sep 5, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-and-patch branch 2 times, most recently from b3649e6 to b906eb5 Compare September 8, 2026 16:26
@renovate
renovate Bot force-pushed the renovate/all-minor-and-patch branch 9 times, most recently from 13cdacb to 6dc7adc Compare September 18, 2026 09:40
@renovate
renovate Bot force-pushed the renovate/all-minor-and-patch branch 2 times, most recently from 561e668 to 8f7a931 Compare September 24, 2026 04:45
@renovate

renovate Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 5 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=1 day

Details:

Package Change
go.opentelemetry.io/otel v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/trace v1.44.0 -> v1.45.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0 -> v0.0.0-20260803160001-6ac0973c030d
k8s.io/code-generator v0.37.0 -> v0.37.1
k8s.io/component-base v0.37.0 -> v0.37.1

@renovate
renovate Bot force-pushed the renovate/all-minor-and-patch branch from 8f7a931 to 7f9c53e Compare September 25, 2026 02:50
@renovate
renovate Bot force-pushed the renovate/all-minor-and-patch branch from 7f9c53e to b7e04db Compare September 29, 2026 12:35
…tRecorder

controller-runtime v0.25 changed manager.Manager.GetEventRecorder to return
recorder.EventRecorder (events.EventRecorder + events.AnnotatedEventRecorder)
instead of events.EventRecorder. Update the fakeManager in the namespaced
variables controller test accordingly and regenerate the cluster-scoped
counterpart. *events.FakeRecorder already satisfies the wider interface.

Signed-off-by: Markus Siebert <markus.siebert@deutschebahn.com>
Assisted-by: Kiro:claude-opus-4.8
@markussiebert
markussiebert force-pushed the renovate/all-minor-and-patch branch from 5b84011 to 2b60c82 Compare September 30, 2026 12:09
@markussiebert markussiebert self-assigned this Sep 30, 2026
@markussiebert
markussiebert merged commit 2caaf72 into master Sep 30, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants