Skip to content

chore(deps): bump the go group across 1 directory with 10 updates#910

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-2c383912e5
Closed

chore(deps): bump the go group across 1 directory with 10 updates#910
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-2c383912e5

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 3, 2026 •
edited
Loading

Bumps the go group with 10 updates in the / directory:

Package From To
github.com/Masterminds/semver/v3 3.4.0 3.5.0
github.com/distribution/distribution/v3 3.1.0 3.1.1
github.com/fluxcd/helm-controller/api 1.5.3 1.5.4
github.com/fluxcd/kustomize-controller/api 1.8.3 1.8.4
github.com/fluxcd/pkg/kustomize 1.30.0 1.31.0
github.com/fluxcd/pkg/runtime 0.103.0 0.105.0
github.com/fluxcd/source-controller/api 1.8.2 1.8.3
github.com/onsi/gomega 1.39.1 1.40.0
k8s.io/apimachinery 0.35.4 0.36.0
sigs.k8s.io/e2e-framework 0.6.0 0.7.0

Updates github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0

Release notes

Sourced from github.com/Masterminds/semver/v3's releases.

v3.5.0

What's Changed

New Contributors

Full Changelog: Masterminds/semver@v3.4.0...v3.5.0

Changelog

Sourced from github.com/Masterminds/semver/v3's changelog.

Changelog

Commits
  • 8b89c86 Merge pull request #287 from mattfarina/fix-da-issues
  • 29d51d0 Fixing some quality issues
  • 87f651d Merge pull request #286 from mattfarina/update-devcontainer
  • 158a685 Updating gitignore for devcontainers
  • 7e83c08 Merge pull request #284 from Masterminds/dependabot/github_actions/golangci/g...
  • 697e27f Merge pull request #283 from Masterminds/dependabot/github_actions/actions/ca...
  • 1591f8e Merge pull request #282 from Masterminds/dependabot/github_actions/github/cod...
  • 3f5ff17 Bump golangci/golangci-lint-action from 7.0.1 to 9.2.0
  • 04baa33 Bump actions/cache from 4.2.3 to 5.0.5
  • 45939fe Bump github/codeql-action from 4.35.1 to 4.35.2
  • Additional commits viewable in compare view

Updates github.com/distribution/distribution/v3 from 3.1.0 to 3.1.1

Release notes

Sourced from github.com/distribution/distribution/v3's releases.

v3.1.1

Welcome to the v3.1.1 release of registry!

This is a stable release

Please try out the release binaries and report any issues at https://github.com/distribution/distribution/issues.

Notable Changes

  • Fixes CVE-2026-41888
  • Bounds-check the file basename in PurgeUploads Walk callback
  • Add S3 Express One Zone support to the S3 storage driver (#4858)
  • Fix tag list endpoint in proxy mode (#4846)
  • Clamp oversized n query parameter in proxy mode instead of returning 400 (#4856)

See the full changelog below for the full list of changes.

What's Changed

New Contributors

Full Changelog: distribution/distribution@v3.1.0...v3.1.1

Commits
  • 9a8d98b chore(release): prepare for v3.1.1 release (#4864)
  • d3c0df9 chore(release): prepare for v3.1.1 release
  • e09ff10 Merge commit from fork
  • 8baf3e0 fix: prevent tag deletion when storage.delete.enabled is false
  • f3af4de fix(storage): bounds-check the file basename in PurgeUploads Walk callback (#...
  • 72c88bc fix(storage): bounds-check the file basename in PurgeUploads Walk callback
  • 1b5e226 feat(s3): add express zone one support to S3 driver (#4858)
  • afd2bf0 fix(proxy): clamp oversized n query param instead of returning 400 (#4856)
  • 835c1c5 feat(s3): add express zone one support to S3 driver
  • 0f3e627 build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 (#4853)
  • Additional commits viewable in compare view

Updates github.com/fluxcd/helm-controller/api from 1.5.3 to 1.5.4

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.5.4

Changelog

v1.5.4 changelog

Container images

  • docker.io/fluxcd/helm-controller:v1.5.4
  • ghcr.io/fluxcd/helm-controller:v1.5.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.5.4

Release date: 2026-04-21

This patch release fixes a post-renderer conflict between overlapping hooks and templates, and preserves line endings in SplitManifests for downstream YAML parsers. It also ensures force-replace is ignored when server-side apply is enabled.

Fixes:

  • Ignore force replace when server-side apply is enabled #1456
  • Fix post-renderer conflict of overlapping hooks and templates #1461
Commits
  • e8ee8f1 Merge pull request #1465 from fluxcd/release-v1.5.4
  • 8fbff28 Release v1.5.4
  • b488998 Add changelog entry for v1.5.4
  • d7e3de0 Merge pull request #1461 from fluxcd/backport-1460-to-release/v1.5.x
  • 23589e6 Fix post-renderer conflict of overlapping hooks and templates
  • bba8fd3 Merge pull request #1456 from fluxcd/backport-1455-to-release/v1.5.x
  • 86234ac Ignore force replace when server-side apply is enabled
  • See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.8.3 to 1.8.4

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.8.4

Changelog

v1.8.4 changelog

Container images

  • docker.io/fluxcd/kustomize-controller:v1.8.4
  • ghcr.io/fluxcd/kustomize-controller:v1.8.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.8.4

Release date: 2026-04-21

This patch release introduces the MigrateAPIVersion feature gate for migrating the API version of resources in managed field entries, which fixes errors like dry-run failed: .spec.accessPolicy: field not declared in schema.

Improvements:

  • Introduce support for migrating API version #1639
  • Update fluxcd/pkg dependencies #1637
Commits
  • b1937c6 Merge pull request #1640 from fluxcd/release-v1.8.4
  • 66a3c0f Release v1.8.4
  • 2916d88 Add changelog entry for v1.8.4
  • 3d2ba16 Merge pull request #1639 from fluxcd/backport-1635-to-release/v1.8.x
  • 745c45c Introduce support for migrating API version
  • 9f05e0d Merge pull request #1637 from fluxcd/update-pkg-deps/release/v1.8.x
  • 133fc92 Update fluxcd/pkg dependencies
  • See full diff in compare view

Updates github.com/fluxcd/pkg/kustomize from 1.30.0 to 1.31.0

Commits

Updates github.com/fluxcd/pkg/runtime from 0.103.0 to 0.105.0

Commits
  • f595d79 Merge pull request #1188 from fluxcd/release-main
  • 0177f62 Prepare for release
  • d2cda98 Merge pull request #1187 from fluxcd/fix-cel-observed-gen
  • 3619c73 runtime/cel: fix requiring int status.observedGeneration
  • 4f94dc6 Merge pull request #1186 from guineveresaenger/drop-autoscaling-v2beta2-hpa
  • b5624d8 Remove autoscaling/v2beta2 from HPA normalization
  • 1bfcca4 Merge pull request #1184 from fluxcd/release-main
  • 29717cf Prepare for release
  • 56b4f16 Merge pull request #1183 from fluxcd/cel-api-group
  • 6b6497f runtime/cel: allow empty kind in status reader
  • Additional commits viewable in compare view

Updates github.com/fluxcd/source-controller/api from 1.8.2 to 1.8.3

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.8.3

Changelog

v1.8.3 changelog

Container images

  • docker.io/fluxcd/source-controller:v1.8.3
  • ghcr.io/fluxcd/source-controller:v1.8.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.8.3

Release date: 2026-04-21

This patch release updates go-git to v5.18.0, which includes performance improvements for Git operations, and comes with dependency updates.

Improvements:

  • Update go-git to v5.18.0 (includes perf improvements) #2031 #2036
Commits
  • 3633126 Merge pull request #2037 from fluxcd/release-v1.8.3
  • fae6096 Release v1.8.3
  • 489330c Add changelog entry for v1.8.3
  • e02124d Merge pull request #2036 from fluxcd/update-pkg-deps/release/v1.8.x
  • 76d7009 Update fluxcd/pkg dependencies
  • c55dac8 Merge pull request #2031 from fluxcd/backport-2030-to-release/v1.8.x
  • e891e80 Update go-git to v5.17.2 (includes perf improvements)
  • See full diff in compare view

Updates github.com/onsi/gomega from 1.39.1 to 1.40.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.40.0

1.40.0

We're adopting a new release strategy to minimize dependency bloat in projects that consume Gomega. It is a limitation of the go mod toolchain that test subdependencies of your project's direct dependencies get pulled in as indirect dependencies. In the case of Gomega, this ends up pulling in all of Ginkgo into your go.mod even if you are only using Gomega (Gomega uses Ginkgo for its own tests).

Going forward, releases will strip out all tests, tidy up the go.mod and then push this stripped down version to a new master-lite branch. These stripped-down versions will receive the vx.y.z git tag and will be picked up by the go toolchain.

Please open an issue if this new release process causes unexpected changes for your projects.

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.40.0

We're adopting a new release strategy to minimize dependency bloat in projects that consume Gomega. It is a limitation of the go mod toolchain that test subdependencies of your project's direct dependencies get pulled in as indirect dependencies. In the case of Gomega, this ends up pulling in all of Ginkgo into your go.mod even if you are only using Gomega (Gomega uses Ginkgo for its own tests).

Going forward, releases will strip out all tests, tidy up the go.mod and then push this stripped down version to a new master-lite branch. These stripped-down versions will receive the vx.y.z git tag and will be picked up by the go toolchain.

Please open an issue if this new release process causes unexpected changes for your projects.

Commits

Updates k8s.io/apimachinery from 0.35.4 to 0.36.0

Commits
  • debe1eb Update dependencies to v0.36.0 tag
  • efb7f26 Merge remote-tracking branch 'origin/master' into release-1.36
  • d966e56 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
  • 79b3632 Merge pull request #137864 from yongruilin/dv-dra-mismatch
  • a8822f7 Add slice and map union member support with tests
  • 7dba2d0 Use IsZero instead of IsNil for union ratcheting check
  • d95710f Fix union validation ratcheting when oldObj is nil
  • 729062d Merge pull request #137849 from bryantbiggs/deps/update-kube-openapi
  • 13b12e6 dependencies: bump kube-openapi to drop ginkgo/gomega indirect deps
  • 27f4670 Merge pull request #136657 from Jefftree/sharding-test
  • Additional commits viewable in compare view

Updates sigs.k8s.io/e2e-framework from 0.6.0 to 0.7.0

Release notes

Sourced from sigs.k8s.io/e2e-framework's releases.

v0.7.0

What's Changed

  • Resources.ExecInDeployment method — execute commands in a pod of a Deployment (@​keeprocking, #506)
  • KUBECONFIG path list support — handle colon-separated KUBECONFIG env var values (@​ndbaker1, #510)
  • Extend GetKubeconfig methods with args — explicit args for kubeconfig retrieval (@​mjudeikis, #471)
  • DecodeURL function in decoder package — decode manifests from URLs (@​dmvolod, #475)
  • kwok WithWaitDuration ClusterOpts — configurable wait duration for kwok cluster setup (@​liam-mackie, #479)
  • Enhance DaemonSetReady — check rollout completion in addition to readiness (@​pschulten, #547)
  • third_party/helm context support — provide context.Context via Option (@​chancez, #549)
  • Cluster providers receive context — pass context.Context when creating clusters (@​chancez, #557)
  • Testcontainers example — new example showing testcontainers integration (@​prit342, #520)

Bug Fixes

  • Test scope per-feature — fix scope handling so tests are scoped per-feature (@​ndbaker1, #517)
  • Fail-fast excludes skipped tests — skipped tests no longer trigger fail-fast (@​faganihajizada, #545)
  • Milliseconds/Second timestamp bug — correct unit conversion (@​zhaodiaoer, #552)
  • Cilium test repair — fix broken Cilium test due to upstream change (@​harshanarayana, #493)
  • Staticcheck fixes in example — SA4022 and SA1029 in kind_with_config (@​av-petrov, #528)

Structural Changes

  • examples/ carved out as its own Go module — reduces the main module's dependency surface (@​faganihajizada, #546)
  • Bump Go / golangci-lint and clean CI — toolchain refresh and CI tidy-up (@​cpanato, #548)

Documentation

  • Fix example doc parameters — correct parameters in example documentation (@​prit342, #516)
  • Docstring & tense cleanup in config.go — typo fix and present-tense normalization (@​Steven-Yiran, #529)

Dependency Updates

Routine dependabot maintenance kept the module current across Go deps, testcontainers example deps, and GitHub Actions. Notable version ranges:

  • Go deps: sigs.k8s.io/controller-runtime 0.20.0 → 0.22.4 · sigs.k8s.io/yaml 1.4.0 → 1.6.0 · golang.org/x/net 0.33.0 → 0.38.0 · github.com/vladimirvivien/gexe 0.4.1 → 0.5.0
  • Examples/testcontainers: github.com/docker/docker 28.2.2 → 28.3.3 · github.com/moby/spdystream 0.5.0 → 0.5.1 · golang.org/x/crypto 0.37.0 → 0.45.0
  • GitHub Actions: actions/setup-go 5.2.0 → 6.4.0 · actions/checkout 4.2.2 → 6.0.2 · goreleaser/goreleaser-action 6.1.0 → 7.1.0

⚠️ Possible Breaking Changes

These changes were thoroughly reviewed to avoid breaking changes with the current API. However, because of signature changes, there exist a small possibility of your code breaking.

  • Cluster provider interfaces now receive context.Context (#557)
  • GetKubeconfig method extended with variable args (#471)
  • examples/ is now a separate Go module (#546)

🎉 New Contributors

... (truncated)

Commits
  • 7d89e24 Merge pull request #563 from kubernetes-sigs/dependabot/github_actions/gorele...
  • 43ebb99 build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.1.0
  • 08a5ab3 Merge pull request #561 from kubernetes-sigs/dependabot/go_modules/examples/t...
  • 27cf407 build(deps): bump github.com/moby/spdystream in /examples/testcontainers
  • 2d2ccad Merge pull request #559 from kubernetes-sigs/dependabot/go_modules/examples/a...
  • 34f39d9 build(deps): bump the all group in /examples with 2 updates
  • 7491cec Merge pull request #557 from chancez/pr/chancez/cluster_providers_use_ctx
  • 919f544 fix: Pass Context when getting kubeconfig for cluster providers
  • b4aba23 fix: Pass context to cluster providers when creating clusters
  • c2722ec Merge pull request #546 from faganihajizada/fix/carve-out-examples-module-540
  • Additional commits viewable in compare view

@dependabot dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels May 3, 2026
@dependabot dependabot Bot requested a review from a team as a code owner May 3, 2026 15:04
@dependabot dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels May 3, 2026
@morri-son
Copy link
Copy Markdown
Contributor

morri-son commented May 5, 2026

@dependabot rebase

@dependabot
chore(deps): bump the go group across 1 directory with 10 updates
f6435d0 
Bumps the go group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) | `3.4.0` | `3.5.0` |
| [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) | `3.1.0` | `3.1.1` |
| [github.com/fluxcd/helm-controller/api](https://github.com/fluxcd/helm-controller) | `1.5.3` | `1.5.4` |
| [github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller) | `1.8.3` | `1.8.4` |
| [github.com/fluxcd/pkg/kustomize](https://github.com/fluxcd/pkg) | `1.30.0` | `1.31.0` |
| [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.103.0` | `0.105.0` |
| [github.com/fluxcd/source-controller/api](https://github.com/fluxcd/source-controller) | `1.8.2` | `1.8.3` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.39.1` | `1.40.0` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.35.4` | `0.36.0` |
| [sigs.k8s.io/e2e-framework](https://github.com/kubernetes-sigs/e2e-framework) | `0.6.0` | `0.7.0` |



Updates `github.com/Masterminds/semver/v3` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/Masterminds/semver/releases)
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md)
- [Commits](Masterminds/semver@v3.4.0...v3.5.0)

Updates `github.com/distribution/distribution/v3` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/distribution/distribution/releases)
- [Commits](distribution/distribution@v3.1.0...v3.1.1)

Updates `github.com/fluxcd/helm-controller/api` from 1.5.3 to 1.5.4
- [Release notes](https://github.com/fluxcd/helm-controller/releases)
- [Changelog](https://github.com/fluxcd/helm-controller/blob/main/CHANGELOG.md)
- [Commits](fluxcd/helm-controller@v1.5.3...v1.5.4)

Updates `github.com/fluxcd/kustomize-controller/api` from 1.8.3 to 1.8.4
- [Release notes](https://github.com/fluxcd/kustomize-controller/releases)
- [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md)
- [Commits](fluxcd/kustomize-controller@v1.8.3...v1.8.4)

Updates `github.com/fluxcd/pkg/kustomize` from 1.30.0 to 1.31.0
- [Commits](fluxcd/pkg@kustomize/v1.30.0...kustomize/v1.31.0)

Updates `github.com/fluxcd/pkg/runtime` from 0.103.0 to 0.105.0
- [Commits](fluxcd/pkg@runtime/v0.103.0...runtime/v0.105.0)

Updates `github.com/fluxcd/source-controller/api` from 1.8.2 to 1.8.3
- [Release notes](https://github.com/fluxcd/source-controller/releases)
- [Changelog](https://github.com/fluxcd/source-controller/blob/main/CHANGELOG.md)
- [Commits](fluxcd/source-controller@v1.8.2...v1.8.3)

Updates `github.com/onsi/gomega` from 1.39.1 to 1.40.0
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.39.1...v1.40.0)

Updates `k8s.io/apimachinery` from 0.35.4 to 0.36.0
- [Commits](kubernetes/apimachinery@v0.35.4...v0.36.0)

Updates `sigs.k8s.io/e2e-framework` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/kubernetes-sigs/e2e-framework/releases)
- [Changelog](https://github.com/kubernetes-sigs/e2e-framework/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/e2e-framework@v0.6.0...v0.7.0)

---
updated-dependencies:
- dependency-name: github.com/distribution/distribution/v3
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/fluxcd/helm-controller/api
  dependency-version: 1.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/fluxcd/kustomize-controller/api
  dependency-version: 1.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/fluxcd/pkg/kustomize
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/pkg/runtime
  dependency-version: 0.105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/fluxcd/source-controller/api
  dependency-version: 1.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/Masterminds/semver/v3
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: sigs.k8s.io/e2e-framework
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/go-2c383912e5 branch from 6d6feb0 to f6435d0 Compare May 5, 2026 07:07
@Skarlso
Copy link
Copy Markdown
Contributor

Skarlso commented May 5, 2026

@dependabot rebase

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 5, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 5, 2026
@dependabot dependabot Bot deleted the dependabot/go_modules/go-2c383912e5 branch May 5, 2026 07:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matthiasbruns matthiasbruns matthiasbruns approved these changes

Assignees

No one assigned

Labels

kind/chore chore, maintenance, etc. kind/dependency dependency update, etc.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@morri-son @Skarlso @matthiasbruns