build(deps): bump the github-dependencies group across 1 directory with 11 updates#7742
build(deps): bump the github-dependencies group across 1 directory with 11 updates#7742dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
…th 11 updates Bumps the github-dependencies group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.7` | `1.32.8` | | [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2) | `0.1.0` | `0.1.3` | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) | `1.279.2` | `1.289.1` | | [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy) | `1.7.2` | `1.8.2` | | [github.com/google/cel-go](https://github.com/google/cel-go) | `0.26.1` | `0.27.0` | | [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.27.5` | `2.28.1` | | [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.39.0` | `1.39.1` | | [github.com/operator-framework/api](https://github.com/operator-framework/api) | `0.37.0` | `0.39.0` | | [github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring](https://github.com/prometheus-operator/prometheus-operator) | `0.88.0` | `0.89.0` | Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.7 to 1.32.8 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@v1.32.7...v1.32.8) Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.19.7 to 1.19.8 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/m2/v1.19.7...service/m2/v1.19.8) Updates `github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager` from 0.1.0 to 0.1.3 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@v0.1.0...ec2imds/v0.1.3) Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.279.2 to 1.289.1 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/ec2/v1.279.2...service/ec2/v1.289.1) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.94.0 to 1.96.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.94.0...service/s3/v1.96.0) Updates `github.com/elazarl/goproxy` from 1.7.2 to 1.8.2 - [Release notes](https://github.com/elazarl/goproxy/releases) - [Commits](elazarl/goproxy@v1.7.2...v1.8.2) Updates `github.com/google/cel-go` from 0.26.1 to 0.27.0 - [Release notes](https://github.com/google/cel-go/releases) - [Commits](google/cel-go@v0.26.1...v0.27.0) Updates `github.com/onsi/ginkgo/v2` from 2.27.5 to 2.28.1 - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.27.5...v2.28.1) Updates `github.com/onsi/gomega` from 1.39.0 to 1.39.1 - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](onsi/gomega@v1.39.0...v1.39.1) Updates `github.com/operator-framework/api` from 0.37.0 to 0.39.0 - [Release notes](https://github.com/operator-framework/api/releases) - [Changelog](https://github.com/operator-framework/api/blob/master/RELEASE.md) - [Commits](operator-framework/api@v0.37.0...v0.39.0) Updates `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` from 0.88.0 to 0.89.0 - [Release notes](https://github.com/prometheus-operator/prometheus-operator/releases) - [Changelog](https://github.com/prometheus-operator/prometheus-operator/blob/main/CHANGELOG.md) - [Commits](prometheus-operator/prometheus-operator@v0.88.0...v0.89.0) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.32.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.19.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager dependency-version: 0.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2 dependency-version: 1.289.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.96.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-dependencies - dependency-name: github.com/elazarl/goproxy dependency-version: 1.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-dependencies - dependency-name: github.com/google/cel-go dependency-version: 0.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-dependencies - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.28.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-dependencies - dependency-name: github.com/onsi/gomega dependency-version: 1.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-dependencies - dependency-name: github.com/operator-framework/api dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-dependencies - dependency-name: github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring dependency-version: 0.89.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
area/ci-tooling
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
WalkthroughDependency versions updated across go.mod, including AWS SDK v2, Kubernetes components, gRPC, OpenTelemetry, Prometheus, and related transitive dependencies to newer patch and minor releases. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 118: The controller-runtime version change to
sigs.k8s.io/controller-runtime v0.23.1 conflicts with an existing replace pin to
v0.19.7 and other deps (cluster-api v1.10.4, operator-framework/api v0.39.0,
Kubernetes v0.35.0); either revert the controller-runtime update in go.mod to
the previous compatible version or remove the replace directive forcing v0.19.7
and complete the required webhook.Validator migration before bumping
controller-runtime; update go.mod so controller-runtime, cluster-api,
operator-framework/api, and Kubernetes versions are mutually compatible (or
configure Dependabot to ignore controller-runtime until migration is done) and
ensure any code changes for webhook.Validator are implemented in the codebase
before removing the replace.
- Line 45: The go.mod upgrade to github.com/google/cel-go v0.27.0 may break
“types as variables” behavior and operator-framework/api v0.39.0 upgrades
Kubernetes deps—verify compatibility by locating the dependency line
"github.com/google/cel-go v0.27.0" and the operator-framework api bump, search
for any CEL policy code or admission/validation logic that treats types as
variables (e.g., policy expressions or code using cel.Env/Program creation), and
either (a) update those expressions to the new CEL semantics or (b) pin revert
the cel-go version until you can update policies; also run full unit/integration
tests against k8s API versions referenced by operator-framework/api v0.39.0, run
go mod tidy and go test, and if needed update CRD schemas to match
controller-runtime/k8s.io dependency changes before merging.
- Around line 94-101: The go.mod pins controller-runtime v0.19.7 which is not
compatible/tested with the k8s.io/* v0.35.0 modules; update to a
controller-runtime version that supports k8s.io v0.35 (e.g., controller-runtime
v0.22+), then run go mod tidy and fix any API changes (notably migrate usages of
webhook.Validator referenced in your code to the new webhook admission APIs) OR,
if you choose to keep v0.19.7, add a clear comment and project documentation
stating the known unsupported dependency combination (controller-runtime v0.19.7
vs k8s.io/* v0.35.0) and accept the testing/support implications.
| github.com/go-logr/stdr v1.2.2 | ||
| github.com/go-logr/zapr v1.3.0 | ||
| github.com/google/cel-go v0.26.1 | ||
| github.com/google/cel-go v0.27.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n go.mod | head -80Repository: openshift/hypershift
Length of output: 4538
🌐 Web query:
google/cel-go v0.27.0 release notes changelog
💡 Result:
google/cel-go v0.27.0 — release notes / changelog (released Jan 30, 2026)
Breaking change
- Remove “types as variables”: type-handling logic was relaxed to avoid collisions with newly introduced types; policies relying on types behaving as variables may need updates. [1]
Features & enhancements
- REPL/tooling
- YAML env configuration read/write support. [1]
- “Parse-only” evaluation mode. [1]
- CEL test coverage calculation + reporter updates for error/unknown cases. [1]
- Core library
- Regex cost estimation/tracking. [1]
- Exposed CEL JSON types to help convert to native values. [1]
- Preserve source info during policy composition (better debugging). [1]
- Extensibility
- Extension option factory resolves by ID; match output compiling refactor; expose match source ID. [1]
- Build/maintenance
- Bazel: migrate to Bazel module only + dependent-build config improvements; cleanup/linting (incl. removing
strcasedep and AppEngine REPL code). [1]
- Bazel: migrate to Bazel module only + dependent-build config improvements; cleanup/linting (incl. removing
Bug fixes
- Fix race condition in checker for reference types. [1]
- Fix namespace resolution issue. [1]
- Formatting directives aligned with CEL spec requirements. [1]
Full changelog: v0.26.1...v0.27.0 (GitHub release page). [1]
Sources: [1]
🌐 Web query:
operator-framework/api v0.39.0 release notes changelog breaking changes
💡 Result:
operator-framework/api v0.39.0 — release notes / changelog / breaking changes
Potentially breaking changes
- Kubernetes 1.35 support (k8s
0.35.0):v0.39.0“adds support for k8s 1.35”, and this requires some API changes. (github.com)- In practice, this lands as updated k8s deps (e.g.,
k8s.io/api,k8s.io/apimachinery,k8s.io/client-go→0.35.0) and controller-runtime →0.23.x. (github.com) - The PR behind this includes CRD schema/content updates aligned to newer Kubernetes API behavior (examples visible in the diff include updated toleration operator docs and other schema text/fields changes). (github.com)
- In practice, this lands as updated k8s deps (e.g.,
What changed (from the GitHub release entry)
- Fix k8s dependencies CI (
#469) (github.com) - Bump
sigs.k8s.io/controller-runtime0.23.0→0.23.1(#470) (github.com) - Move binary dependency management to bingo (
#471) (github.com) - Bump
github.com/google/cel-go0.26.1→0.27.0(#472) (github.com) - Upgrade Go module dependencies (“edge”) (
#473) (github.com)
Full changelog / compare
- GitHub “Full Changelog” compare:
v0.38.0...v0.39.0. (github.com)
Citations:
- 1: https://github.com/operator-framework/api/releases/tag/v0.39.0
- 2: Fix k8s dependencies ci operator-framework/api#469
- 3: https://github.com/operator-framework/api/pull/469/files
- 4: https://github.com/operator-framework/api/releases/tag/v0.39.0
- 5: https://github.com/operator-framework/api/releases/tag/v0.39.0
- 6: https://github.com/operator-framework/api/releases/tag/v0.39.0
- 7: https://github.com/operator-framework/api/releases/tag/v0.39.0
- 8: https://github.com/operator-framework/api/releases/tag/v0.39.0
- 9: https://github.com/operator-framework/api/releases/tag/v0.39.0
🌐 Web query:
prometheus-operator v0.89.0 release notes changelog
💡 Result:
prometheus-operator v0.89.0 — changelog (released 2026-02-05)
Enhancements
- Add
hostNetworkfield to theAlertmanagerCRD. (github.com) - Add
crdsandfull-crdscommands to the operator binary. (github.com) - Report deprecated field usage in the
Reconciledcondition type. (github.com) - Avoid unnecessary reconciliation on
ThanosRulerStatefulSet creation. (github.com) - Add
bodySizeLimitto theScrapeConfigCRD. (github.com) - Support
http_headersfield in the Alertmanager Secret. (github.com) - Add
-kubelet-http-metricsflag (default enabled) for the Kubelet endpoint HTTP metrics port. (github.com) - Include
operator.prometheus.io/versionannotation in the full version of CRDs. (github.com)
Bug fixes
- Add/extend validation for multiple Alertmanager + AlertmanagerConfig integrations (e.g., VictorOps, Jira, Webex, OpsGenie, WeChat, SNS, Telegram, RocketChat). (github.com)
- Restore StatefulSet labels if creation fails with
AlreadyExists. (github.com) - Fix potential panic due to informer cache races. (github.com)
- Support IPv6 addresses for probers in the
ProbeCRD. (github.com) - Prevent zero-duration group/repeat intervals from breaking Alertmanager. (github.com)
- Fix GCE service discovery for the
ScrapeConfigCRD. (github.com) - Avoid stale conditions in
Alertmanager,ThanosRuler,Prometheus,PrometheusAgent. (github.com) - Fix race conditions updating rule ConfigMaps and patching finalizers. (github.com)
- Reconcile
ScrapeConfigresources when namespace selection changes. (github.com)
If you want, tell me whether you prefer full raw notes (verbatim list) or a grouped summary by area (CRDs, reconciliation behavior, validations, etc.).
Citations:
- 1: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 2: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 3: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 4: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 5: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 6: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 7: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 8: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 9: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 10: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 11: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 12: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 13: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 14: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 15: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 16: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
- 17: https://github.com/prometheus-operator/prometheus-operator/releases/tag/v0.89.0
Verify compatibility with cel-go v0.27.0 breaking change before upgrading.
The google/cel-go v0.27.0 release introduces a breaking change: removal of "types as variables" support. Policies relying on types behaving as variables will require updates. This is especially relevant since operator-framework/api v0.39.0 also bumps cel-go to 0.27.0, so both upgrades carry this risk.
Additionally, operator-framework/api v0.39.0 includes Kubernetes 1.35 support with dependency updates (k8s.io/api, k8s.io/apimachinery, k8s.io/client-go → 0.35.0; controller-runtime → 0.23.x) and CRD schema changes—verify these align with your Kubernetes version and usage patterns.
The prometheus-operator v0.89.0 release contains enhancements and bug fixes without breaking changes; no action required beyond standard testing.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 45, The go.mod upgrade to github.com/google/cel-go v0.27.0
may break “types as variables” behavior and operator-framework/api v0.39.0
upgrades Kubernetes deps—verify compatibility by locating the dependency line
"github.com/google/cel-go v0.27.0" and the operator-framework api bump, search
for any CEL policy code or admission/validation logic that treats types as
variables (e.g., policy expressions or code using cel.Env/Program creation), and
either (a) update those expressions to the new CEL semantics or (b) pin revert
the cel-go version until you can update policies; also run full unit/integration
tests against k8s API versions referenced by operator-framework/api v0.39.0, run
go mod tidy and go test, and if needed update CRD schemas to match
controller-runtime/k8s.io dependency changes before merging.
| k8s.io/api v0.35.0 | ||
| k8s.io/apiextensions-apiserver v0.35.0 | ||
| k8s.io/apimachinery v0.35.0 | ||
| k8s.io/apiserver v0.35.0 | ||
| k8s.io/autoscaler/vertical-pod-autoscaler v1.3.0 | ||
| k8s.io/cli-runtime v0.34.2 | ||
| k8s.io/client-go v0.34.3 | ||
| k8s.io/component-base v0.34.3 | ||
| k8s.io/client-go v0.35.0 | ||
| k8s.io/component-base v0.35.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, check the go.mod file structure and locate the referenced dependencies
cat -n go.mod | tail -150Repository: openshift/hypershift
Length of output: 9380
🏁 Script executed:
# Search for controller-runtime and cluster-api in go.mod with context
rg -A 2 -B 2 "(controller-runtime|cluster-api)" go.modRepository: openshift/hypershift
Length of output: 1623
🏁 Script executed:
# Also check the exact lines mentioned in the review (if they exist)
sed -n '310,340p' go.modRepository: openshift/hypershift
Length of output: 1686
🌐 Web query:
controller-runtime v0.19.7 Kubernetes v0.35.0 compatibility
💡 Result:
controller-runtime v0.19.7 is not considered compatible (supported/tested) with Kubernetes Go modules k8s.io/* v0.35.0 (including k8s.io/apimachinery v0.35.0).
- The controller-runtime project’s published compatibility guidance says each controller-runtime minor version is tested with a specific client-go / k8s.io/ minor*, and other combinations are “by chance” and not supported nor tested. It also lists controller-runtime v0.19 ↔ k8s.io/ v0.31* (not v0.35). [1]
k8s.io/apimachinery v0.35.xis a newer module line (e.g., v0.35.1 published Dec 4, 2025), andv0.35.0exists as well. [2][3]
What to do: use a controller-runtime minor that matches k8s.io/* v0.35 (or downgrade your k8s.io/* deps to v0.31.x if you must stay on controller-runtime v0.19.x). The latest compatibility table visible on pkg.go.dev only goes up to controller-runtime v0.22 ↔ k8s.io/ v0.34*, so you’ll likely need a newer controller-runtime than v0.22 for v0.35. [1]
Sources:
[1] https://pkg.go.dev/sigs.k8s.io/controller-runtime
[2] https://pkg.go.dev/k8s.io/apimachinery/pkg
[3] https://git.autistici.org/smol/assetmon/-/merge_requests/24
🌐 Web query:
Kubernetes v0.35.0 release notes breaking changes
💡 Result:
Kubernetes itself doesn’t have a v0.35.0 release line; v0.35.0 is the Go module tag used by k8s.io/client-go / k8s.io/apimachinery / k8s.io/api that corresponds to Kubernetes v1.35.0. [1]
Kubernetes / k8s.io v0.35.0 (Kubernetes v1.35.0) breaking / action-required changes
- cgroup v1 support is removed: on nodes that only have cgroup v1, the kubelet will fail to start; you must migrate/enable cgroup v2 before upgrading. [2]
- Dynamic Resource Allocation (DRA) is now always enabled (it was GA in v1.34 but could be disabled; in v1.35 it can’t). If you relied on turning it off, that behavior changes in v1.35. [3]
Not breaking immediately, but important upgrade-impact notes in the v1.35 notes
kube-proxyIPVS mode is deprecated (still present, but now warns; migration to nftables is recommended). [2]- v1.35 is the last Kubernetes release supporting containerd v1.x; you must move to containerd 2.0+ before upgrading beyond v1.35. [2]
Sources:
[1] kubernetes/client-go README (versioning; v0.x.y tags match Kubernetes v1.x.y) (github.com)
[2] Kubernetes v1.35 release blog (cgroup v1 removal, IPVS deprecation, containerd v1.x final call) (kubernetes.io)
[3] Kubernetes v1.35 release blog (DRA “always enabled”) (kubernetes.io)
Citations:
- 1: https://github.com/kubernetes/client-go?utm_source=openai
- 2: https://kubernetes.io/blog/2025/12/17/kubernetes-v1-35-release/
- 3: https://kubernetes.io/blog/2025/12/17/kubernetes-v1-35-release/
Confirm: controller-runtime v0.19.7 is unsupported with k8s.io/ v0.35.0 dependencies.*
The pinned controller-runtime v0.19.7 (line 335) is not tested or supported with the k8s.io modules at v0.35.0 (k8s.io/api, k8s.io/apimachinery, k8s.io/apiserver, k8s.io/client-go, k8s.io/component-base). Official compatibility guidance states controller-runtime v0.19 is tested only with k8s.io/* v0.31.
The code comment at line 334 ("webhook.Validator deprecation in v0.20 breaks everything") indicates this is a deliberate trade-off: downgrading from v0.23.1 to v0.19.7 to avoid API breaking changes. However, this creates an unsupported/untested dependency combination.
Options to resolve:
- Update controller-runtime to a version supporting k8s.io/* v0.35 (v0.22+ likely required) and address webhook.Validator deprecation migration
- Or explicitly document and accept this as a known incompatibility with testing/support implications
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` around lines 94 - 101, The go.mod pins controller-runtime v0.19.7
which is not compatible/tested with the k8s.io/* v0.35.0 modules; update to a
controller-runtime version that supports k8s.io v0.35 (e.g., controller-runtime
v0.22+), then run go mod tidy and fix any API changes (notably migrate usages of
webhook.Validator referenced in your code to the new webhook admission APIs) OR,
if you choose to keep v0.19.7, add a clear comment and project documentation
stating the known unsupported dependency combination (controller-runtime v0.19.7
vs k8s.io/* v0.35.0) and accept the testing/support implications.
| sigs.k8s.io/cluster-api-provider-kubevirt v0.1.9 | ||
| sigs.k8s.io/cluster-api-provider-openstack v0.12.1 | ||
| sigs.k8s.io/controller-runtime v0.22.4 | ||
| sigs.k8s.io/controller-runtime v0.23.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Read the go.mod file to verify the claims about line 118 and line 335
head -130 go.mod | tail -15
echo "---"
tail -20 go.modRepository: openshift/hypershift
Length of output: 1602
🏁 Script executed:
# Get complete line context around the critical lines
sed -n '110,130p' go.mod
echo "--- Replace section ---"
sed -n '330,340p' go.modRepository: openshift/hypershift
Length of output: 1535
🏁 Script executed:
# Check what version of controller-runtime cluster-api v1.10.4 requires
echo "=== Checking cluster-api v1.10.4 controller-runtime requirement ==="
curl -sL "https://raw.githubusercontent.com/kubernetes-sigs/cluster-api/v1.10.4/go.mod" 2>/dev/null | grep -A2 -B2 'controller-runtime'
echo -e "\n=== Checking operator-framework/api v0.39.0 controller-runtime requirement ==="
curl -sL "https://raw.githubusercontent.com/operator-framework/api/v0.39.0/go.mod" 2>/dev/null | grep -A2 -B2 'controller-runtime'Repository: openshift/hypershift
Length of output: 505
🏁 Script executed:
# Check the actual K8s version requirements from controller-runtime v0.19.7 and v0.23.1
echo "=== Controller-runtime v0.19.7 K8s requirements ==="
curl -sL "https://raw.githubusercontent.com/kubernetes-sigs/controller-runtime/v0.19.7/go.mod" 2>/dev/null | grep -E 'k8s.io/(api|apimachinery|client-go|component-base)' | head -5
echo -e "\n=== Controller-runtime v0.23.1 K8s requirements ==="
curl -sL "https://raw.githubusercontent.com/kubernetes-sigs/controller-runtime/v0.23.1/go.mod" 2>/dev/null | grep -E 'k8s.io/(api|apimachinery|client-go|component-base)' | head -5Repository: openshift/hypershift
Length of output: 450
🏁 Script executed:
# Verify the exact K8s version in hypershift's go.mod
echo "=== K8s component versions in hypershift go.mod ==="
grep -E 'k8s.io/(api|apimachinery|client-go|apiserver|component-base)' go.mod | head -10Repository: openshift/hypershift
Length of output: 364
🏁 Script executed:
# Double-check cluster-api version dependency constraint
echo "=== Full cluster-api entry in go.mod ==="
grep 'sigs.k8s.io/cluster-api' go.mod | grep -v '//'Repository: openshift/hypershift
Length of output: 705
Controller-runtime version update creates critical dependency conflicts.
The update to sigs.k8s.io/controller-runtime v0.23.1 cannot coexist with the replace directive forcing v0.19.7. This creates multiple incompatibilities:
- cluster-api v1.10.4 requires controller-runtime v0.20.4 or higher; v0.19.7 will not work
- operator-framework/api v0.39.0 requires controller-runtime v0.23.1; v0.19.7 will not work
- Kubernetes v0.35.0 (used throughout go.mod) requires controller-runtime v0.20.x or higher; v0.19.7 only supports K8s v0.31.0
Keeping the replace directive pinned to v0.19.7 while updating K8s components to v0.35.0 and cluster-api to v1.10.4 will cause build failures. The webhook.Validator migration must be completed before updating controller-runtime, or this change should be reverted and Dependabot configured to ignore controller-runtime updates until the migration is complete.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 118, The controller-runtime version change to
sigs.k8s.io/controller-runtime v0.23.1 conflicts with an existing replace pin to
v0.19.7 and other deps (cluster-api v1.10.4, operator-framework/api v0.39.0,
Kubernetes v0.35.0); either revert the controller-runtime update in go.mod to
the previous compatible version or remove the replace directive forcing v0.19.7
and complete the required webhook.Validator migration before bumping
controller-runtime; update go.mod so controller-runtime, cluster-api,
operator-framework/api, and Kubernetes versions are mutually compatible (or
configure Dependabot to ignore controller-runtime until migration is done) and
ensure any code changes for webhook.Validator are implemented in the codebase
before removing the replace.
|
@dependabot[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
bot
deleted the
dependabot/go_modules/github-dependencies-a15a01a54c
branch
1 participant
Bumps the github-dependencies group with 9 updates in the / directory:
1.32.71.32.80.1.00.1.31.279.21.289.11.7.21.8.20.26.10.27.02.27.52.28.11.39.01.39.10.37.00.39.00.88.00.89.0Updates
github.com/aws/aws-sdk-go-v2/configfrom 1.32.7 to 1.32.8Commits
31c2f3fRelease 2025-01-09ed70e6bRegenerated Clients5aef5b0Update partitions file6e21e3fUpdate endpoints model9017824Update API modelebb7c02retry net.ErrClosed by default (#2949)19d2a28Release 2025-01-08e153a59Regenerated Clients349cb94Update endpoints model740de30Update API modelUpdates
github.com/aws/aws-sdk-go-v2/credentialsfrom 1.19.7 to 1.19.8Commits
78fa10aRelease 2025-02-052d65d97Regenerated Clients64e842dUpdate endpoints modelf255e31Update API model68c4649Track accountID endpoint mode in user-agent (#3000)c45eaacRelease 2025-02-047aecaffRegenerated Clientsa11e8e1Update endpoints model91f8178Update API modeld59b658Release 2025-02-03Updates
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanagerfrom 0.1.0 to 0.1.3Commits
d206334Release 2020-10-2659290c5bump SDK core version and name9984c37update module go.sums36fde8acheckpoint for release metadata2a74240tidy SDK module1aeb416update hand written modules smithy-go depdf7bd9aupdate endpoints5f0f033update api models693e56cinternal/repotools/cmd/makerelative: Support Relative Paths for Transitive De...cb36c8dMerge pull request #851 from aws/r53cust-fixUpdates
github.com/aws/aws-sdk-go-v2/service/ec2from 1.279.2 to 1.289.1Commits
03e49f7Release 2026-02-16eb0ac66Regenerated Clients7902ad6Update endpoints modelca03ddaUpdate API model09ac115Release 2026-02-13ab1d333Regenerated Clients5947754Update API model3dca5e4Release 2026-02-127caa4bdRegenerated Clients14cc53eUpdate API modelUpdates
github.com/aws/aws-sdk-go-v2/service/s3from 1.94.0 to 1.96.0Commits
bdb98c5Release 2026-01-28c878d57Regenerated Clients4f5d503Update API modelb7bf952Feat release s3 transfer manager v2 (#3293)0baa1dcRelease 2026-01-2711eae4bRegenerated Clients297caa5Update endpoints model43d96e4Update API modelde58dc6Release 2026-01-26dba39e6Regenerated ClientsUpdates
github.com/elazarl/goproxyfrom 1.7.2 to 1.8.2Release notes
Sourced from github.com/elazarl/goproxy's releases.
Commits
ffdf0b2Fix NewResponse writing HTTP/0.0 status lines in MITM mode (#749)b343a9aMerge HTTPMitmConnect and MitmConnect actions and use the correct one based o...d6c78b7Always close request body even if the proxy server had a custom response retu...c2d45c6Reorganize funding section inside readme44388f6Use chunked response when http2 content length is missing (#742)26d3e75Fix linter configuration & issues (#735)5f52967fix auth remote proxy in cascadeproxy (#664)b81733cBump actions/setup-go from 5 to 6 (#709)2df6d8bBump github.com/coder/websocket from 1.8.12 to 1.8.14 in /examples (#711)1854770Bump github.com/stretchr/testify from 1.10.0 to 1.11.1 in /ext (#708)Updates
github.com/google/cel-gofrom 0.26.1 to 0.27.0Release notes
Sourced from github.com/google/cel-go's releases.
... (truncated)
Commits
450089bPreserve source information during CEL policy composition. (#1253)c66b313Remove types as variables to allow user-defined variables to shadow type decl...bff3a72Expose the CEL JSON types to assist with conversion to native values (#1261)559cbc9Remove errant diff checked into a prior PR (#1260)fe26efaSimplify the disambiguation logic to a single boolean (#1263)52280baClean up unused source info after checker rewrites the AST. (#1258)3cb5705Namespace resolution fix (#1256)409bcbeRefactor match output compiling to accept user-defined logic. (#1246)e9f15eaEnable two var comprehension conformance tests. (#1255)057fa1aAdd parse only evaluation to REPL (#1254)Updates
github.com/onsi/ginkgo/v2from 2.27.5 to 2.28.1Release notes
Sourced from github.com/onsi/ginkgo/v2's releases.
Changelog
Sourced from github.com/onsi/ginkgo/v2's changelog.
Commits
5d1d628v2.28.1676f985update test mu language8032100appease go vet41ca807bump dependencies2b2305bv2.28.071d2d89feat: support component semantic version filtering8cbbcb4Fix doclink for ginkgo runUpdates
github.com/onsi/gomegafrom 1.39.0 to 1.39.1Release notes
Sourced from github.com/onsi/gomega's releases.
Changelog
Sourced from github.com/onsi/gomega's changelog.
Commits
1a25a36v1.39.1406faeebump all depsUpdates
github.com/operator-framework/apifrom 0.37.0 to 0.39.0Release notes
Sourced from github.com/operator-framework/api's releases.
Commits
884ff95chore(deps): upgrade Go module dependencies (edge) (#473)c8bc31eBump github.com/google/cel-go from 0.26.1 to 0.27.0 (#472)0f51e11move binary dependency management to bingo (#471)da8eedfBump sigs.k8s.io/controller-runtime (#470)8b52a3fFix k8s dependencies ci (#469)2dc4feaBump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 (#467)5fff887🌱 Upgrade controller-gen from v0.18.0 to v0.20.0 (#466)5367cbdMigrate away from ioutil (#463)dfd6338Update to golang 1.25 (#464)aa24971Bump actions/cache from 4 to 5 (#462)Updates
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoringfrom 0.88.0 to 0.89.0Release notes
Sourced from github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring's releases.
Changelog
Sourced from github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring's changelog.
Commits
e13fb15chore: update go.mod files (#8361)cca237fchore: update go.mod files1469a69Merge pull request #8360 from simonpasquier/cut-0.89.02d28b87chore: cut v0.89.05f5061eMerge pull request #8359 from prometheus-operator/dependabot/github_actions/i...f0259bcadd URL validation for SNS receiver (#8259)0262ae3build(deps): bump imjasonh/setup-crane from 0.4 to 0.55e8d9c5feat: integrate all supported rocketchat attributes for alertmanagerconfig CR...69b3653fix: validate nonzero duration in AlertmanagerConfig (#8126)8eb57b7fix: support IPv6 addresses in prober URL validation (#8354)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions