Skip to content

chore(deps): Bump the k8s group across 1 directory with 4 updates#877

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/k8s-87aaf15862
Open

chore(deps): Bump the k8s group across 1 directory with 4 updates#877
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/k8s-87aaf15862

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 4, 2026 •
edited
Loading

Bumps the k8s group with 3 updates in the / directory: k8s.io/apimachinery, k8s.io/client-go and sigs.k8s.io/controller-runtime.

Updates k8s.io/apimachinery from 0.35.3 to 0.36.1

Commits
  • 7af103a Update dependencies to v0.36.1 tag
  • efb7f26 Merge remote-tracking branch 'origin/master' into release-1.36
  • d966e56 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
  • 79b3632 Merge pull request #137864 from yongruilin/dv-dra-mismatch
  • a8822f7 Add slice and map union member support with tests
  • 7dba2d0 Use IsZero instead of IsNil for union ratcheting check
  • d95710f Fix union validation ratcheting when oldObj is nil
  • 729062d Merge pull request #137849 from bryantbiggs/deps/update-kube-openapi
  • 13b12e6 dependencies: bump kube-openapi to drop ginkgo/gomega indirect deps
  • 27f4670 Merge pull request #136657 from Jefftree/sharding-test
  • Additional commits viewable in compare view

Updates k8s.io/client-go from 0.35.3 to 0.36.1

Commits
  • 55ef15a Update dependencies to v0.36.1 tag
  • f22a53e Merge remote-tracking branch 'origin/master' into release-1.36
  • a948641 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
  • 7e44ffc Add Workload-Aware Preemption fields to Workload and PodGroup APIs
  • df2d882 Merge pull request #136989 from nojnhuh/podgroup-resourceclaim
  • 4eece52 Workload API: PodGroup ResourceClaims (KEP-5729)
  • 3d35c51 Merge pull request #137190 from everpeace/KEP-5491-alpha
  • 0434117 Merge pull request #137028 from nmn3m/feature/dra-resource-pool-status
  • ba785be Drop CSR analogy, mark ObjectMeta +required,reduce limits (maxItems=500, maxL...
  • 4a9c878 Add ResourcePoolStatusRequest API types and generated code
  • Additional commits viewable in compare view

Updates k8s.io/utils from 0.0.0-20251002143259-bc988d571ff4 to 0.0.0-20260210185600-b8788abfbbc2

Commits

Updates sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.1

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.24.1

What's Changed

Full Changelog: kubernetes-sigs/controller-runtime@v0.24.0...v0.24.1

v0.24.0

⚠️ Breaking Changes

🐛 Bug Fixes

  • Cache: Fix IndexField blocking until informer is synced (#3445)
  • Cache: Wait for cache sync when ReaderFailOnMissingInformer is true (#3425)
  • Client: Update typed ApplyConfigurations with server response (#3475)
  • Fakeclient: Fix SSA status patch resource version check (#3443)
  • Fakeclient: Fix panic when using CRs with embedded pointer structs (#3431)
  • Fakeclient: Fix status apply if existing object has managedFields set (#3430)
  • Fakeclient: Retry GenerateName on AlreadyExists collisions (#3498)
  • HTTP servers: Wire up base context into http servers (#3452)

🌱 Others

  • Builder/Webhooks: Remove deprecated custom path function (#3465)
  • Cache: Test cache reader waits for cache sync (#3434)
  • Certwatcher: Deflake certwatcher tests (#3457)
  • Dependencies: Use forked version of btree (#3449)
  • Envtest: Ensure envtest stops the whole process group (#3447)
  • Logging: Add missing space in zap-log-level flag description (#3492)
  • Misc: Adopt new(x) over ptr.To(x) and re-enable newexpr lint (#3489)
  • Owners: Cleanup (#3453)
  • Recorder: Add logger into context for structured logging (#3454)
  • Recorder: Switch to StartLogging for event debug logs (#3451)
  • Scheme: Deprecate the scheme builder (#3461)
  • Source/Kind: Improve logging for dynamic type kind source (#3494)
  • Webhooks: Reduce memory usage of default webhooks (#3463 #3468)

🌱 CI & linters

  • Chore: Update golangci-lint version to v2.8.0 (#3448)
  • Chore: Update golangci-lint version to v2.10.1 (#3470)
  • Chore: Update golangci-lint version to v2.11.3 (#3482)
  • Migrate away from custom GitHub action approval workflow (#3491)
  • Release: Auto-create git tags for the tools/setup-envtest submodule (#3476)

📖 Additionally, there has been 1 contribution to our documentation. (#3477)

Dependencies

... (truncated)

Commits
  • 3be3f1b Merge pull request #3516 from k8s-infra-cherrypick-robot/cherry-pick-3515-to-...
  • 0f7b33d Fix regression in Apply typed error handling
  • d3eaef3 Merge pull request #3475 from alvaroaleman/fixfix
  • 3296f32 🐛 Update typed Applyconfigurations with server response
  • c8b4b9d Merge pull request #3506 from troy0820/troy0820/update-deps-k8s
  • 557c314 update to k8s.io v1.36.0
  • e4a998c Merge pull request #3499 from kubernetes-sigs/dependabot/github_actions/all-g...
  • 1a31c56 Merge pull request #3498 from vieux/fix-fake-client-generatename-retry
  • 80bc294 fakeclient: retry GenerateName on AlreadyExists collisions (match K8s 1.32 be...
  • 77b730a 🌱 Bump the all-github-actions group with 2 updates
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels May 4, 2026
@dependabot dependabot Bot requested a review from a team as a code owner May 4, 2026 08:59
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels May 4, 2026
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 4, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedsigs.k8s.io/​controller-runtime@​v0.23.3 ⏵ v0.24.173 +1100100100100
Updatedk8s.io/​apimachinery@​v0.35.3 ⏵ v0.36.174100100100100
Updatedk8s.io/​client-go@​v0.35.3 ⏵ v0.36.175 +110010075100
Updatedk8s.io/​api@​v0.35.3 ⏵ v0.36.176 +1100100100100
Updatedk8s.io/​utils@​v0.0.0-20251002143259-bc988d571ff4 ⏵ v0.0.0-20260210185600-b8788abfbbc288 +1100100100100

View full report

@dependabot dependabot Bot force-pushed the dependabot/go_modules/k8s-87aaf15862 branch from 31ee138 to e40f65a Compare May 11, 2026 10:27
@dependabot dependabot Bot force-pushed the dependabot/go_modules/k8s-87aaf15862 branch 2 times, most recently from 5404463 to 87f49cb Compare May 25, 2026 11:37
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 25, 2026 •
edited
Loading

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: golang k8s.io/client-go is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: go.mod → golang/k8s.io/client-go@v0.36.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/k8s.io/client-go@v0.36.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot
chore(deps): Bump the k8s group across 1 directory with 4 updates
6b5428b 
Bumps the k8s group with 3 updates in the / directory: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery), [k8s.io/client-go](https://github.com/kubernetes/client-go) and [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime).


Updates `k8s.io/apimachinery` from 0.35.3 to 0.36.1
- [Commits](kubernetes/apimachinery@v0.35.3...v0.36.1)

Updates `k8s.io/client-go` from 0.35.3 to 0.36.1
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.35.3...v0.36.1)

Updates `k8s.io/utils` from 0.0.0-20251002143259-bc988d571ff4 to 0.0.0-20260210185600-b8788abfbbc2
- [Commits](https://github.com/kubernetes/utils/commits)

Updates `sigs.k8s.io/controller-runtime` from 0.23.3 to 0.24.1
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.23.3...v0.24.1)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: k8s
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: k8s
- dependency-name: k8s.io/utils
  dependency-version: 0.0.0-20260210185600-b8788abfbbc2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: k8s
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/k8s-87aaf15862 branch from 87f49cb to 6b5428b Compare May 26, 2026 05:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants