fix(deps): update kubernetes packages to v0.36.2#126
fix(deps): update kubernetes packages to v0.36.2#126red-hat-konflux[bot] wants to merge 1 commit into
Conversation
red-hat-konflux
Bot
added
approved
ℹ️ Artifact update noticeFile name: api/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
red-hat-konflux
Bot
added
approved
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughGo toolchain updated to 1.26.0 in both ChangesGo and Kubernetes dependency upgrades
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/go.mod`:
- Around line 6-7: Update k8s.io/apiextensions-apiserver from v0.35.3 to v0.36.2
in both go.mod files to align with the versions of k8s.io/apimachinery and other
Kubernetes packages. In api/go.mod at lines 6-7, change the
k8s.io/apiextensions-apiserver version to v0.36.2. In go.mod at lines 8-12, find
and update the k8s.io/apiextensions-apiserver entry to v0.36.2 as well. These
Kubernetes-staged packages must use matching versions to ensure API
compatibility.
- Line 3: The test agent Dockerfile contains an outdated Go version reference
that does not match the updated go.mod version. Locate the FROM statement in the
test agent Dockerfile that references golang:1.25.7-bookworm and update it to
golang:1.26.0-bookworm to align with the go.mod files which have been updated to
go 1.26.0. This ensures the test agent image builds correctly without version
mismatches.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b8af7b22-a7b7-4b5e-9878-b0ab1186069f
⛔ Files ignored due to path filters (2)
api/go.sumis excluded by!**/*.sum,!api/go.sumgo.sumis excluded by!**/*.sum,!go.sum
📒 Files selected for processing (2)
api/go.modgo.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
| module github.com/openshift/lightspeed-agentic-operator/api | ||
|
|
||
| go 1.25.7 | ||
| go 1.26.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check Dockerfile Go version directive
grep -n "golang:" test/agent/DockerfileRepository: openshift/lightspeed-agentic-operator
Length of output: 122
🏁 Script executed:
#!/bin/bash
# Find all Dockerfiles to check for stale Go versions
find . -name "Dockerfile*" -o -name "dockerfile*" | xargs ls -la 2>/dev/nullRepository: openshift/lightspeed-agentic-operator
Length of output: 216
🏁 Script executed:
#!/bin/bash
# Check for Go version references in all Dockerfiles
find . \( -name "Dockerfile*" -o -name "dockerfile*" \) -type f -exec grep -Hn "golang:" {} \;Repository: openshift/lightspeed-agentic-operator
Length of output: 146
🏁 Script executed:
#!/bin/bash
# Check the root go.mod to confirm the version bump
head -10 go.mod | grep -E "^go "Repository: openshift/lightspeed-agentic-operator
Length of output: 91
🏁 Script executed:
#!/bin/bash
# Check CI/CD workflows to see if Go version is enforced
find . -path ./.git -prune -o \( -name "*.yaml" -o -name "*.yml" \) -type f -exec grep -l "go.*version\|golang\|Go" {} \; | grep -E "(\.github|\.gitlab|\.circleci|Makefile)" | head -10Repository: openshift/lightspeed-agentic-operator
Length of output: 63
🏁 Script executed:
#!/bin/bash
# Check if go.mod version directive is strictly enforced (Go 1.21+)
rg "^go 1\.[0-9]+" go.mod api/go.modRepository: openshift/lightspeed-agentic-operator
Length of output: 119
🏁 Script executed:
#!/bin/bash
# Check the root Dockerfile for Go version
cat -n Dockerfile | head -15Repository: openshift/lightspeed-agentic-operator
Length of output: 700
🏁 Script executed:
#!/bin/bash
# Check the test/agent Dockerfile full content
cat -n test/agent/DockerfileRepository: openshift/lightspeed-agentic-operator
Length of output: 1207
🏁 Script executed:
#!/bin/bash
# Check Makefile or build scripts for how these Dockerfiles are used
rg "Dockerfile|docker build" -i Makefile README.md 2>/dev/null || echo "Checking build references..."Repository: openshift/lightspeed-agentic-operator
Length of output: 656
🏁 Script executed:
#!/bin/bash
# Check if there's a way to determine what Go version UBI9 go-toolset:9.8 provides
# or if there are other references to Go version requirements
rg "go.*1\.26|1\.25" --type go --type md --type txt | head -20Repository: openshift/lightspeed-agentic-operator
Length of output: 63
🏁 Script executed:
#!/bin/bash
# Check if there are CI workflows that would catch this mismatch
find . -path ./.git -prune -o -type d -name ".github" -o -name ".gitlab-ci" -o -name ".circleci" -printRepository: openshift/lightspeed-agentic-operator
Length of output: 63
🏁 Script executed:
#!/bin/bash
# Check .github for workflow files
find .github -name "*.yml" -o -name "*.yaml" 2>/dev/null | xargs cat 2>/dev/null | grep -A 5 -B 5 "test/agent\|docker" | head -40Repository: openshift/lightspeed-agentic-operator
Length of output: 63
test/agent/Dockerfile Go version must be updated to 1.26.0.
The go.mod files were updated to go 1.26.0, but test/agent/Dockerfile (line 7) still pins golang:1.25.7-bookworm. This will cause build failures when the test agent image is built (e.g., make -C test/agent docker-build). Update line 7 to FROM golang:1.26.0-bookworm AS builder to match the go.mod version.
The root Dockerfile is unaffected—it uses registry.redhat.io/ubi9/go-toolset:9.8, which does not pin an explicit Go version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@api/go.mod` at line 3, The test agent Dockerfile contains an outdated Go
version reference that does not match the updated go.mod version. Locate the
FROM statement in the test agent Dockerfile that references
golang:1.25.7-bookworm and update it to golang:1.26.0-bookworm to align with the
go.mod files which have been updated to go 1.26.0. This ensures the test agent
image builds correctly without version mismatches.
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/kubernetes-go
branch
from
c8fdc67 to
5870a0c
Compare
|
New changes are detected. LGTM label has been removed. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 3: Update the Go version directive in go.mod from 1.26.0 to 1.26.4 or
later to patch multiple security vulnerabilities (CVEs 2026-27137, 2026-27138,
2026-27142, 2026-25679, 2026-27139, and 2026-27144). Change the go statement at
line 3 to specify Go 1.26.4, which is the current stable release that addresses
all known security issues in the crypto/x509, html/template, net/url, os
package, and compiler components.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 686edd05-bdf2-4125-bd91-dd08a3e8d345
⛔ Files ignored due to path filters (2)
api/go.sumis excluded by!**/*.sum,!api/go.sumgo.sumis excluded by!**/*.sum,!go.sum
📒 Files selected for processing (2)
api/go.modgo.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
🚧 Files skipped from review as they are similar to previous changes (1)
- api/go.mod
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/kubernetes-go
branch
from
5870a0c to
949016e
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
go.mod (1)
3-3:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winGo 1.26.0 contains multiple unpatched security vulnerabilities; upgrade to 1.26.4 or later.
Go 1.26.0 has 6 known CVEs affecting crypto/x509 (CVE-2026-27137, CVE-2026-27138), html/template XSS (CVE-2026-27142), net/url IPv6 validation (CVE-2026-25679), os package root escape (CVE-2026-27139), and compiler memory corruption (CVE-2026-27144). Use Go 1.26.4, the current stable release, to patch these security issues.
🔧 Proposed fix
-go 1.26.0 +go 1.26.4🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 3, The go.mod file specifies Go 1.26.0 which contains multiple unpatched security vulnerabilities including CVEs in crypto/x509, html/template, net/url, os package, and the compiler. Update the Go version directive from 1.26.0 to 1.26.4 (or a later stable release) to address these security issues.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 3: The go.mod file specifies Go version 1.26.0, but the Dockerfile
builder stage in test/agent/Dockerfile uses golang:1.25.7-bookworm which is an
older version. When the Go 1.25.7 toolchain tries to build a module requiring
1.26.0, the build will fail. Update the builder image in test/agent/Dockerfile
from golang:1.25.7-bookworm to golang:1.26.4-bookworm (or any later 1.26.x
version) to match the go.mod requirement.
---
Duplicate comments:
In `@go.mod`:
- Line 3: The go.mod file specifies Go 1.26.0 which contains multiple unpatched
security vulnerabilities including CVEs in crypto/x509, html/template, net/url,
os package, and the compiler. Update the Go version directive from 1.26.0 to
1.26.4 (or a later stable release) to address these security issues.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 30214f68-d3a8-40b6-a625-897105b9574b
⛔ Files ignored due to path filters (2)
api/go.sumis excluded by!**/*.sum,!api/go.sumgo.sumis excluded by!**/*.sum,!go.sum
📒 Files selected for processing (2)
api/go.modgo.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
🚧 Files skipped from review as they are similar to previous changes (1)
- api/go.mod
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/kubernetes-go
branch
from
949016e to
13643e9
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/kubernetes-go
branch
2 times, most recently
from
c82729b to
5c2dc69
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
api/go.mod (1)
6-7:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAlign
k8s.io/apiextensions-apiserverwith the rest of the Kubernetes stack.
api/go.modstill pinsk8s.io/apiextensions-apiservertov0.35.3while the sibling Kubernetes modules are onv0.36.2. These staged modules are meant to move in lockstep; leaving one behind risks API/compile incompatibility at the boundary.As per coding guidelines, pin exact versions and keep dependency updates consistent across module boundaries.
🔎 Verification script
#!/bin/bash set -euo pipefail rg -n 'k8s.io/(apiextensions-apiserver|apimachinery|api|cli-runtime|client-go)' api/go.mod go.mod🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/go.mod` around lines 6 - 7, The k8s.io/apiextensions-apiserver dependency in api/go.mod is pinned to v0.35.3 while other Kubernetes modules like k8s.io/apimachinery are on v0.36.2, creating a version mismatch that risks API incompatibility. Update the k8s.io/apiextensions-apiserver version from v0.35.3 to v0.36.2 to align it with the rest of the Kubernetes dependency stack in the module, ensuring all staged Kubernetes modules move in lockstep.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@api/go.mod`:
- Around line 6-7: The k8s.io/apiextensions-apiserver dependency in api/go.mod
is pinned to v0.35.3 while other Kubernetes modules like k8s.io/apimachinery are
on v0.36.2, creating a version mismatch that risks API incompatibility. Update
the k8s.io/apiextensions-apiserver version from v0.35.3 to v0.36.2 to align it
with the rest of the Kubernetes dependency stack in the module, ensuring all
staged Kubernetes modules move in lockstep.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 06259c74-c430-4722-8007-37d25fd004ac
⛔ Files ignored due to path filters (2)
api/go.sumis excluded by!**/*.sum,!api/go.sumgo.sumis excluded by!**/*.sum,!go.sum
📒 Files selected for processing (2)
api/go.modgo.mod
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
🚧 Files skipped from review as they are similar to previous changes (1)
- go.mod
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/kubernetes-go
branch
5 times, most recently
from
9826cbb to
2f25950
Compare
openshift-ci
Bot
added
the
needs-rebase
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/kubernetes-go
branch
from
2f25950 to
6c67e77
Compare
openshift-ci
Bot
removed
the
needs-rebase
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/kubernetes-go
branch
from
6c67e77 to
72ee74c
Compare
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/kubernetes-go
branch
5 times, most recently
from
8b6a1d2 to
e0a0ab3
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/kubernetes-go
branch
from
e0a0ab3 to
a307507
Compare
|
@red-hat-konflux[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
v0.35.3→v0.36.2v0.35.3→v0.36.2v0.35.3→v0.36.2v0.35.3→v0.36.2v0.35.3→v0.36.2Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
kubernetes/api (k8s.io/api)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
kubernetes/apiextensions-apiserver (k8s.io/apiextensions-apiserver)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
kubernetes/apimachinery (k8s.io/apimachinery)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
kubernetes/cli-runtime (k8s.io/cli-runtime)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
kubernetes/client-go (k8s.io/client-go)
v0.36.2Compare Source
v0.36.1Compare Source
v0.36.0Compare Source
v0.35.6Compare Source
v0.35.5Compare Source
v0.35.4Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.