Skip to content

fix(deps): update gomod dependencies - #477

Open
red-hat-konflux-kflux-prd-rh03[bot] wants to merge 1 commit into
masterfrom
konflux/mintmaker/master/gomod-dependencies
Open

fix(deps): update gomod dependencies#477
red-hat-konflux-kflux-prd-rh03[bot] wants to merge 1 commit into
masterfrom
konflux/mintmaker/master/gomod-dependencies

Conversation

@red-hat-konflux-kflux-prd-rh03

@red-hat-konflux-kflux-prd-rh03 red-hat-konflux-kflux-prd-rh03 Bot commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
github.com/fxamacker/cbor/v2 v2.9.0 → v2.9.3 age confidence indirect patch
github.com/go-openapi/jsonreference v1.0.0 → v1.0.1 age confidence indirect patch
github.com/go-openapi/swag v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/cmdutils v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/conv v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/fileutils v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/jsonutils v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/loading v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/mangling v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/netutils v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/pools v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/stringutils v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/typeutils v0.28.0 → v0.29.1 age confidence indirect minor
github.com/go-openapi/swag/yamlutils v0.28.0 → v0.29.1 age confidence indirect minor
github.com/google/gnostic-models v0.7.0 → v0.7.1 age confidence indirect patch
github.com/onsi/gomega v1.42.1 → v1.43.0 age confidence require minor
github.com/openshift/api 5c75e62 → 8127870 replace digest
github.com/openshift/api 5c75e62 → 8127870 require digest
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.89.0 → v0.93.1 age confidence require minor
github.com/prometheus-operator/prometheus-operator/pkg/client v0.89.0 → v0.93.1 age confidence require minor
github.com/prometheus/procfs v0.21.1 → v0.22.0 age confidence indirect minor
github.com/stretchr/testify v1.12.0 → v1.12.1 age confidence indirect patch
go.yaml.in/yaml/v3 v3.0.4 → v3.0.5 age confidence indirect patch
golang.org/x/mod v0.39.0 → v0.40.0 age confidence indirect minor
k8s.io/api v0.35.2 → v0.37.0 age confidence require minor
k8s.io/apiextensions-apiserver v0.35.2 → v0.37.0 age confidence indirect minor
k8s.io/apimachinery v0.35.2 → v0.37.0 age confidence require minor
k8s.io/client-go v0.35.2 → v0.37.0 age confidence require minor
k8s.io/kube-openapi d427ff9 → be32def age confidence require digest
sigs.k8s.io/controller-runtime v0.23.0 → v0.24.1 age confidence require minor
sigs.k8s.io/e2e-framework v0.6.0 → v0.7.0 age confidence indirect minor
sigs.k8s.io/structured-merge-diff/v6 v6.4.1 → v6.4.2 age confidence indirect patch

Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.3

Compare Source

This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.

Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.

Upgrading to v2.9.3 is recommended.

The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.

What's Changed

  • Skip data item when decoding to time.Time fails under certain conditions by @​fxamacker in #​803

Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3

v2.9.2

Compare Source

This release refactors and hardens the streaming encoder by adding stricter checks for encoding CBOR indefinite-length data. Other changes include minor bugfixes, defensive checks, and more tests.

Projects that don't use CBOR indefinite-length data may also want to upgrade (summary of prior releases).

The stricter checks in the encoder prevent improper use of the library and bad inputs from producing malformed CBOR indefinite-length data that would be rejected by the decoder.

This release passed fuzz tests (billions of execs) and it is production quality.

What's Changed

  • Reject encoding indefinite-length map with odd item count by @​fxamacker in #​764
  • Reject encoding indefinite-length data item as a chunk inside indefinite-length byte string or text string by @​fxamacker in #​765
  • Make TagSet.Remove a no-op when contentType is nil by @​fxamacker in #​766
  • Refactor indefinite-length encoding and improve chunk validation during encoding by @​fxamacker in #​767
  • Add more tests, fix a nit in unreachable panic message, update docs & ci by @​fxamacker in #​768
CI / GitHub Actions and Docs
🔎 Details...

Full Changelog: fxamacker/cbor@v2.9.1...v2.9.2

v2.9.1

Compare Source

This release includes important bugfixes, defensive checks, improved code quality, and more tests. Although not public, the fuzzer was also improved by adding more fuzz tests.

🐞 Bug fixes related to the keyasint feature

These changes only affect Go struct fields tagged with keyasint:

  • [Decoding] Reject integer keys that exceed math.MaxInt64 when decoding CBOR map to a struct with keyasint field (PR #​757)
  • [Decoding] Prevent string representation of an integer key from matching the struct field tagged by keyasint (PR #​757)
  • [Encoding & Decoding] Deduplicate struct fields with the same normalized keyasint tag values (PR #​757)
🐞 Other bug fixes and defensive checks

Some of the bugs fixed are related to decoding extreme values that cannot be encoded with this library. For example, the decoder checks if epoch time encoded as CBOR float value representing hundreds of billions of years overflows int64(seconds).

NOTE: It is generally good practice to avoid using floating point to store epoch time (even when not using CBOR).

  • [Decoding] Reject decoding epoch time encoded as floats that overflow int64 (PR #​753)
  • [Encoding] Return a cloned slice for an empty RawMessage from RawMessage.MarshalCBOR (PR #​753)
  • [Encoding] Reject encoding nil inside indefinite-length strings (PR #​750)
  • [Diagnostic] Accept valid U+FFFD replacement character (PR #​753)

What's Changed

CI / GitHub Actions and Docs
🔎 Details...

New Contributors

Full Changelog: fxamacker/cbor@v2.9.0...v2.9.1

go-openapi/jsonreference (github.com/go-openapi/jsonreference)

v1.0.1

Compare Source

1.0.1 - 2026-08-25

Full Changelog: go-openapi/jsonreference@v1.0.0...v1.0.1

12 commits in this release.

Fixed bugs
  • fix: keep NormalizeURL's output parseable when dropping a default port by @​fredbi ...
Documentation
Performance
  • perf: replace the duplicate-slash regexp in NormalizeURL with a scan by @​fredbi ...
Miscellaneous tasks
Updates
Other (technical)
People who contributed to this release

jsonreference license terms

License

go-openapi/swag (github.com/go-openapi/swag)

v0.29.1

Compare Source

0.29.1 - 2026-08-21

Full Changelog: go-openapi/swag@v0.29.0...v0.29.1

4 commits in this release.

Testing
Miscellaneous tasks
Updates
People who contributed to this release

swag license terms

License

Per-module changes
conv (0.29.1)
Miscellaneous tasks
jsonname (0.29.1)
Miscellaneous tasks
jsonutils/adapters/easyjson (0.29.1)
Miscellaneous tasks
jsonutils/adapters/testintegration/benchmarks (0.29.1)
Miscellaneous tasks
jsonutils/adapters/testintegration (0.29.1)
Miscellaneous tasks
jsonutils (0.29.1)
Testing
Miscellaneous tasks
loading (0.29.1)
Miscellaneous tasks
mangling (0.29.1)
Miscellaneous tasks
netutils (0.29.1)
Miscellaneous tasks
pools (0.29.1)
Miscellaneous tasks
stringutils (0.29.1)
Miscellaneous tasks
typeutils (0.29.1)
Miscellaneous tasks
yamlutils (0.29.1)
Miscellaneous tasks

v0.29.0

Compare Source

0.29.0 - 2026-08-19

New fsutils on top of io.FS

Full Changelog: go-openapi/swag@v0.28.0...v0.29.0

10 commits in this release.

Implemented enhancements
Documentation
Testing
  • test: rename the fixtures directories to testdata by @​fredbi ...
Miscellaneous tasks
Updates
Other (technical)
People who contributed to this release

swag license terms

License

Per-module changes
conv (0.29.0)
Miscellaneous tasks
fileutils (0.29.0)
Implemented enhancements
jsonname (0.29.0)
Miscellaneous tasks
jsonutils/adapters/easyjson (0.29.0)
Miscellaneous tasks
Updates
jsonutils/adapters/testintegration/benchmarks (0.29.0)
Testing
  • test: rename the fixtures directories to testdata by @​fredbi ...
Miscellaneous tasks
Updates
Other (technical)
jsonutils/adapters/testintegration (0.29.0)
Miscellaneous tasks
Updates
jsonutils/fixtures_test (0.29.0)
Miscellaneous tasks
Updates
jsonutils (0.29.0)
Miscellaneous tasks
Updates
loading (0.29.0)
Testing
  • test: rename the fixtures directories to testdata by @​fredbi ...
Miscellaneous tasks
Updates
Other (technical)
mangling (0.29.0)
Miscellaneous tasks
netutils (0.29.0)
Miscellaneous tasks
pools (0.29.0)
Miscellaneous tasks
stringutils (0.29.0)
Miscellaneous tasks
typeutils (0.29.0)
Miscellaneous tasks
yamlutils (0.29.0)
Testing
  • test: rename the fixtures directories to testdata by @​fredbi ...
Miscellaneous tasks
Updates
Other (technical)
google/gnostic-models (github.com/google/gnostic-models)

v0.7.1

Compare Source

onsi/gomega (github.com/onsi/gomega)

v1.43.0

Compare Source

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

prometheus-operator/prometheus-operator (github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring)

v0.93.1: 0.93.1 / 2026-08-10

Compare Source

  • [BUGFIX] Fix duplicate kubelet targets for nodes reporting several addresses of the same IP family. #​8739
  • [BUGFIX] Fix argument list for Thanos containers when custom TLS ciphers or curves are specified. #​8749

v0.93.0: 0.93.0 / 2026-07-28

Compare Source

  • [CHANGE] Switch from uint to int types in the Go definition of the CRDs and add API validations to reject negative values. #​8662 #​8666
  • [CHANGE] Keep local Prometheus compaction enabled when the Thanos sidecar uploads to object storage, for Prometheus >= v3.9.0 and Thanos >= v0.41.0. The operator now coordinates uploads through the shipper meta file (--storage.tsdb.delay-compact-file.path, --shipper.meta-file-name, --shipper.ignore-unequal-block-size) instead of disabling compaction. Set spec.disableCompaction: true to keep the previous behavior. #​8694
  • [CHANGE] Define a default value of 1 for .spec.shards for Prometheus and PrometheusAgent CRDs. #​8691
  • [CHANGE/BUGFIX] Add validation markers to all unsigned int fields to reject negative values. #​8662
  • [CHANGE/BUGFIX] Disable metadata sending when the remote-write configuration uses message version v2.0. #​8700
  • [FEATURE] Add updateMessage field to the Slack receiver in the AlertmanagerConfig CRD. #​8506
  • [FEATURE] Add chunkEncoding field to TSDBSpec for runtime float encoding selection in Prometheus and PrometheusAgent CRDs. #​8675
  • [ENHANCEMENT] Use pod's name as the peer name for Alertmanager >= v0.30.0. #​8705
  • [BUGFIX] Create IPv6 EndpointSlice for the kubelet Service on dual-stack clusters. #​8682

v0.92.1: 0.92.1 / 2026-06-30

Compare Source

  • [BUGFIX] Fix "namespace not found" errors when the operator watches monitoring and workload resources in different resources. #​8658

v0.92.0: 0.92.0 / 2026-06-18

Compare Source

[!NOTE]
The PrometheusTopologySharding and PrometheusShardRetentionPolicy feature gates have been promoted to Beta in this release and are now enabled by default. See the sharding documentation for details.

  • [CHANGE] Add URL validation for the tokenUrl fiel

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • Between 02:00 AM and 04:59 AM, Monday through Friday (* 2-4 * * 1-5)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux-kflux-prd-rh03 red-hat-konflux-kflux-prd-rh03 Bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. labels Aug 19, 2026
@red-hat-konflux-kflux-prd-rh03

red-hat-konflux-kflux-prd-rh03 Bot commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go mod tidy
go: downloading github.com/onsi/ginkgo/v2 v2.32.1
go: downloading github.com/onsi/gomega v1.43.0
go: downloading github.com/openshift/osde2e-common v0.0.0-20260723151626-dcf3e27b8016
go: downloading github.com/stretchr/testify v1.12.1
go: downloading sigs.k8s.io/e2e-framework v0.7.0
go: downloading github.com/go-openapi/testify/v2 v2.6.1
go: downloading go.uber.org/goleak v1.3.0
go: downloading github.com/google/gofuzz v1.2.0
go: downloading github.com/vladimirvivien/gexe v0.5.0
go: downloading github.com/klauspost/compress v1.19.1
go: downloading github.com/stretchr/objx v0.5.3
go: downloading github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.1
go: downloading github.com/go-openapi/testify/enable/yaml/v2 v2.6.1
go: downloading github.com/gkampitakis/go-snaps v0.5.15
go: downloading github.com/joshdk/go-junit v1.0.0
go: downloading github.com/mfridman/tparse v0.18.0
go: downloading github.com/Masterminds/semver/v3 v3.5.0
go: downloading github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
go: downloading k8s.io/streaming v0.37.0
go: downloading github.com/kylelemons/godebug v1.1.0
go: downloading github.com/go-task/slim-sprig/v3 v3.0.0
go: downloading golang.org/x/tools v0.49.0
go: downloading github.com/gkampitakis/ciinfo v0.3.2
go: downloading github.com/gkampitakis/go-diff v1.3.2
go: downloading github.com/goccy/go-yaml v1.18.0
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/maruel/natural v1.1.1
go: downloading github.com/tidwall/gjson v1.18.0
go: downloading github.com/tidwall/pretty v1.2.1
go: downloading k8s.io/component-base v0.37.0
go: downloading github.com/moby/spdystream v0.5.1
go: downloading github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3
go: downloading github.com/tidwall/sjson v1.2.5
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/rogpeppe/go-internal v1.14.1
go: downloading github.com/tidwall/match v1.1.1
go: downloading golang.org/x/mod v0.40.0
go: downloading github.com/blang/semver/v4 v4.0.0
go: downloading go.opentelemetry.io/otel/trace v1.44.0
go: downloading go.opentelemetry.io/otel v1.44.0
go: downloading github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
go: finding module for package k8s.io/api/autoscaling/v2beta2
go: finding module for package k8s.io/api/autoscaling/v2beta1
go: finding module for package k8s.io/api/scheduling/v1alpha1
go: github.com/openshift/splunk-forwarder-operator/test/e2e imports
	github.com/openshift/osde2e-common/pkg/clients/openshift imports
	github.com/openshift/api imports
	k8s.io/api/autoscaling/v2beta1: module k8s.io/api@latest found (v0.37.0), but does not contain package k8s.io/api/autoscaling/v2beta1
go: github.com/openshift/splunk-forwarder-operator/test/e2e imports
	github.com/openshift/osde2e-common/pkg/clients/openshift imports
	github.com/openshift/api imports
	k8s.io/api/autoscaling/v2beta2: module k8s.io/api@latest found (v0.37.0), but does not contain package k8s.io/api/autoscaling/v2beta2
go: github.com/openshift/splunk-forwarder-operator/test/e2e imports
	github.com/openshift/osde2e-common/pkg/clients/openshift imports
	github.com/openshift/api imports
	k8s.io/api/scheduling/v1alpha1: module k8s.io/api@latest found (v0.37.0), but does not contain package k8s.io/api/scheduling/v1alpha1

@openshift-ci
openshift-ci Bot requested review from anispate and tnierman August 19, 2026 04:03
@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 19, 2026
@openshift-ci

openshift-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Hi @red-hat-konflux-kflux-prd-rh03[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-merge-bot

openshift-merge-bot Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD ce04e5e and 2 for PR HEAD ea66449 in total

@openshift-merge-bot

openshift-merge-bot Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 31086d2 and 1 for PR HEAD ea66449 in total

@openshift-ci

openshift-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

@red-hat-konflux-kflux-prd-rh03[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/images ea66449 link true /test images
ci/prow/test ea66449 link true /test test
ci/prow/validate ea66449 link true /test validate
ci/prow/rosa-sts-e2e ea66449 link true /test rosa-sts-e2e
ci/prow/coverage ea66449 link true /test coverage
ci/prow/e2e-binary-build-success ea66449 link true /test e2e-binary-build-success
ci/prow/lint ea66449 link true /test lint
ci/prow/osd-gcp-e2e ea66449 link true /test osd-gcp-e2e

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@red-hat-konflux-kflux-prd-rh03
red-hat-konflux-kflux-prd-rh03 Bot force-pushed the konflux/mintmaker/master/gomod-dependencies branch from ea66449 to be660ef Compare August 21, 2026 04:03
@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 21, 2026
@openshift-ci

openshift-ci Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

New changes are detected. LGTM label has been removed.

@red-hat-konflux-kflux-prd-rh03
red-hat-konflux-kflux-prd-rh03 Bot force-pushed the konflux/mintmaker/master/gomod-dependencies branch 5 times, most recently from 20d442b to 92d09ee Compare August 28, 2026 04:03
@red-hat-konflux-kflux-prd-rh03
red-hat-konflux-kflux-prd-rh03 Bot force-pushed the konflux/mintmaker/master/gomod-dependencies branch 2 times, most recently from e99c78f to a88f56a Compare September 1, 2026 04:02
@openshift-ci

openshift-ci Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux-kflux-prd-rh03[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@red-hat-konflux-kflux-prd-rh03
fix(deps): update gomod dependencies
37c89fa 
Signed-off-by: red-hat-konflux-kflux-prd-rh03 <206760901+red-hat-konflux-kflux-prd-rh03[bot]@users.noreply.github.com>
@red-hat-konflux-kflux-prd-rh03
red-hat-konflux-kflux-prd-rh03 Bot force-pushed the konflux/mintmaker/master/gomod-dependencies branch from a88f56a to 37c89fa Compare September 2, 2026 04:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anispate anispate Awaiting requested review from anispate
@tnierman tnierman Awaiting requested review from tnierman

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants