Update go updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/fxamacker/cbor/v2	v2.9.1 → v2.9.2			indirect	patch
go.yaml.in/yaml/v2	v2.4.4 → v3.0.4			indirect	major
gopkg.in/evanphx/json-patch.v4	v4.13.0 → v5.9.11			indirect	major
k8s.io/api	v0.35.4 → v0.36.0			indirect	minor
k8s.io/apimachinery	v0.35.4 → v0.36.0			indirect	minor
k8s.io/client-go	v0.35.4 → v0.36.0			indirect	minor
k8s.io/kube-openapi	ec9c827 → 3334182			indirect	digest

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.2

Compare Source

This release refactors and hardens the streaming encoder by adding stricter checks for encoding CBOR indefinite-length data. Other changes include minor bugfixes, defensive checks, and more tests.

Projects that don't use CBOR indefinite-length data may also want to upgrade (summary of prior releases).

The stricter checks in the encoder prevent improper use of the library and bad inputs from producing malformed CBOR indefinite-length data that would be rejected by the decoder.

This release passed fuzz tests (billions of execs) and it is production quality.

What's Changed

• Reject encoding indefinite-length map with odd item count by @​fxamacker in #​764
• Reject encoding indefinite-length data item as a chunk inside indefinite-length byte string or text string by @​fxamacker in #​765
• Make TagSet.Remove a no-op when contentType is nil by @​fxamacker in #​766
• Refactor indefinite-length encoding and improve chunk validation during encoding by @​fxamacker in #​767
• Add more tests, fix a nit in unreachable panic message, update docs & ci by @​fxamacker in #​768

CI / GitHub Actions and Docs

🔎 Details...

• Bump actions/setup-go from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​760
• Bump github/codeql-action from 4.34.1 to 4.35.1 by @​dependabot[bot] in #​761
• Bump github/codeql-action from 4.35.1 to 4.35.2 by @​dependabot[bot] in #​763
• Update README for v2.9.2 release by @​fxamacker in #​769

Full Changelog: fxamacker/cbor@v2.9.1...v2.9.2

yaml/go-yaml (go.yaml.in/yaml/v2)

v3.0.4

v3.0.3

v3.0.2

v3.0.1

v3.0.0

evanphx/json-patch (gopkg.in/evanphx/json-patch.v4)

v5.9.11

Compare Source

What's Changed

• Export errBadJSONDoc and errBadJSONPatch errors by @​skitt in #​209

Full Changelog: evanphx/json-patch@v5.9.10...v5.9.11

v5.9.10

Compare Source

What's Changed

• Drop the reference to gopkg.in for v5 by @​skitt in #​203
• remove unmaintained errors pkg(github.com/pkg/errors) by @​koba1t in #​206

New Contributors

• @​skitt made their first contribution in #​203
• @​koba1t made their first contribution in #​206

Full Changelog: evanphx/json-patch@v5.9.0...v5.9.10

v5.9.0

Compare Source

What's Changed

• Validate that the partialDoc is decoded correctly by @​evanphx in #​201
• Add option to control if the output is HTMLEscaped by @​evanphx in #​202

Full Changelog: evanphx/json-patch@v5.8.1...v5.9.0

v5.8.1: Fix API breakage

Compare Source

This PR fixes Operation containing a reference to internal/json and breaking the ability to manually compose one. This restores that ability using a type alias.

Full Changelog: evanphx/json-patch@v5.8.0...v5.8.1

v5.8.0: Blargh Phixs and Empathyprovements

Compare Source

This release fixes a few stray panics, addresses large number accuracy, and improves performance!

What's Changed

• Compare strings after decoding them to handle unicode correctly. Fixes #​172 by @​evanphx in #​195
• Always use UseNumber() to avoid float64 lossyness by @​evanphx in #​194
• Handle null correctly when introduced by replace. Fixes #​171 by @​evanphx in #​196
• Handle from="" more properly. Fixes #​192 by @​evanphx in #​193
• Improve performance by @​evanphx in #​197

Full Changelog: evanphx/json-patch@v5.7.0...v5.8.0

v5.7.0: The 2023 Release

Compare Source

What's Changed

• Fix invalid sprintf by @​howardjohn in #​152
• Add CIFuzz GitHub action by @​DavidKorczynski in #​167
• README: Remove Travis by @​ohkinozomu in #​164
• Updated min supported version to go 1.18 by @​Neo2308 in #​181
• Added dependabot by @​Neo2308 in #​182
• Pre-flight DecodePatch validation: Issue #​177 by @​radwaretaltr in #​180
• Check if raw is a null pointer for findObject by @​JosieLi-Google in #​173
• Bump actions/checkout from 2 to 4 by @​dependabot in #​187
• Fix panic on test op by @​erickertz in #​158

New Contributors

• @​howardjohn made their first contribution in #​152
• @​DavidKorczynski made their first contribution in #​167
• @​ohkinozomu made their first contribution in #​164
• @​Neo2308 made their first contribution in #​181
• @​radwaretaltr made their first contribution in #​180
• @​JosieLi-Google made their first contribution in #​173
• @​dependabot made their first contribution in #​187
• @​erickertz made their first contribution in #​158

Full Changelog: evanphx/json-patch@v5.6.0...v5.7.0

v5.6.0: Bug fixes

Compare Source

What's Changed

• Function ensurePathExists should handle appending correctly by @​MarcelMue in #​148
• Fix partial negative indice support in v4 by @​zqzten in #​146

New Contributors

• @​MarcelMue made their first contribution in #​148
• @​zqzten made their first contribution in #​146

Full Changelog: evanphx/json-patch@v5.5.0...v5.6.0

v5.5.0: Better null handling

Compare Source

This incorporates a few fixes related to how nulls are handles in array's and objects.

v5.3.0: Fix zero sized document crash

Compare Source

This fixes a crash bug where submitted an empty slice as the document would panic.

v5.2.0

Compare Source

v5.1.0

Compare Source

v5.0.0: Proper Go modules release

Compare Source

This release has a proper /v5 directory, unlike the previous releases that did not have a /v4 dir. Thanks to @​BenTheElder for getting this sorted out!

kubernetes/api (k8s.io/api)

v0.36.0

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

v0.36.0

Compare Source

kubernetes/client-go (k8s.io/client-go)

v0.36.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.0 -> 1.26.0
github.com/pmezard/go-difflib	v1.0.0 -> v1.0.1-0.20181226105442-5d4384ee4fb2
google.golang.org/protobuf	v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af