Skip to content

build(go): Bump the go-dependencies group across 1 directory with 6 updates - #271

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-3a9c5eb840
Open

build(go): Bump the go-dependencies group across 1 directory with 6 updates#271
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-3a9c5eb840

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 6 updates in the / directory:

Package From To
github.com/cert-manager/cert-manager 1.21.0 1.21.2
github.com/stretchr/testify 1.11.1 1.12.1
k8s.io/apimachinery 0.36.3 0.37.0
k8s.io/client-go 0.36.3 0.37.0
sigs.k8s.io/controller-runtime 0.24.1 0.25.0
sigs.k8s.io/external-dns 0.21.0 0.22.0

Updates github.com/cert-manager/cert-manager from 1.21.0 to 1.21.2

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.21.2

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

  • ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#9239, @​FelixPhipps)
  • Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#9222, @​FelixPhipps)
  • De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#9234, @​speer)
  • Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#9240, @​wieghx)
  • Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#9235, @​lunarwhite)
  • Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#9278, @​arpitjain099)
  • Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#9236, @​hjoshi123)
  • Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#9313, @​shashankvarma499)
  • Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#9238, @​thc1006)
  • Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#9312, @​shashankvarma499)
  • Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#9262, @​FelixPhipps)
  • Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#9314, @​KR-Ravindra)
  • The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#9232, @​FelixPhipps)
  • The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#9231, @​FelixPhipps)

Other (Cleanup or Flake)

  • Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. (#9151, @​wallrj)
  • Upgrade Go to 1.26.8. (#9323, @​wallrj)
  • Bump google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities (#9255, #9317)
  • Bump golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities (#9265)

v1.21.1

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

  • Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @​sklirg)
  • Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @​SebTardif)
  • Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @​wallrj-cyberark)
  • Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#9012, @​mateenali66)

Other (Cleanup or Flake)

... (truncated)

Commits
  • 922a06a Merge pull request #9323 from wallrj/release-1.21-go-1.26.8
  • c5e1f72 Merge pull request #9326 from cert-manager/renovate/release-1.21-base-images
  • e5e15f8 chore(deps): update base images
  • 4c0e4d2 Merge pull request #9321 from cert-manager-bot/cherry-pick-9320-to-release-1.21
  • 1d69000 Update vendored Go to 1.26.8
  • 8fdd7dc Merge pull request #9317 from cert-manager/renovate/release-1.21-go-google.go...
  • 37fd8f8 fix(e2e): give each SelfSigned CSR spec its own Secret
  • 5badcbd certificate-shim: do not mutate the cached object's labels (#9303) (#9314)
  • e4abe87 chore(deps): update module google.golang.org/grpc to v1.83.2 [security]
  • 04e9f2b fix(acme): make the custom DNS server rotation counter atomic (#9273) (#9313)
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.36.3 to 0.37.0

Commits
  • 7164e39 Update dependencies to v0.37.0 tag
  • e55f9ba feat(api): Update node restriction admission to use new API
  • cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis
  • 97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api
  • f21afab Add validation for camelcase in reason field
  • d7ad413 Merge pull request #140782 from dims/update-kube-openapi
  • e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist
  • 464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
  • 0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key
  • 95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...
  • Additional commits viewable in compare view

Updates k8s.io/client-go from 0.36.3 to 0.37.0

Commits
  • 2807644 Update dependencies to v0.37.0 tag
  • 50c6f9b metrics: Register: Fix incorrect assignment
  • 49f0a7b Merge pull request #140931 from pohly/client-go-changelog-adding-apigroups
  • 74d4b1e Merge pull request #140966 from alancaldelas/client-go-fakecustomstore-store
  • 2bf14f2 Merge pull request #140990 from xigang/revert-140448
  • 7b892fe Revert "Merge pull request #140448 from xigang/event_broadcaster_goroutine_leak"
  • df92378 Merge pull request #140334 from nojnhuh/dra-workloadresourceclaims-beta
  • 45a0ff1 client-go: restore FakeCustomStore conformance to cache.Store
  • 9d3b531 Merge pull request #139795 from omeryahud/worktree-kep-5963-device-compat-groups
  • 694f4eb apidiff: ignore adding entirely new API groups
  • Additional commits viewable in compare view

Updates sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.25.0

Highlights

This version of controller-runtime introduces a new experimental ReadYourWritesConsistency feature, which ensures that all writes are reflected in subsequent reads from the default cache-backed client. Stale client reads are arguably the biggest source of friction and sometimes bugs for controller authors, providing this functionality at the library level eliminates that class of problems entirely.

Try it out by setting Client.EnableReadYourWritesConsistency: new(true) in your manager and leave any feedback you may have on the tracking issue.

⚠️ Breaking Changes

✨ New Features

  • Client: Add a read-your-own-writes client (#3472)
  • Fakeclient: Add WithGlobalResourceVersionCounter (#3581)
  • Fakeclient: Add scale subresource support for Apply (#3569)
  • Metrics: Allow opt-in for client-go REST client metrics (#3510)
  • Metrics: Allow overriding client-go REST client metrics latency histogram buckets (#3573)
  • Source: Add TypedInformer source (#3520)
  • Webhooks: Allow to disable the webhook server by setting the port to -1 (#3481)

🐛 Bug Fixes

  • Cache: Fix goroutine leaks in cache Start() methods (#3565)
  • Client: Fix regression in Apply typed error handling (#3515)
  • Controller: Unlock when Controller.Start() returns with error (#3545)
  • Envtest: Fix envtest process stop on Windows (#3519)
  • Fakeclient: Allow updating managedFields through Update (#3585)
  • Fakeclient: Fix AddIndex panic when wrapped with an interceptor (#3583)
  • Fakeclient: Fix PartialObjectMeta handling (#3571)
  • Fakeclient: Support scale subresource get/update for unstructured objects (#3546)
  • Fakeclient: Update object on subresource apply (#3570)
  • PriorityQueue: Fix PriorityQueue deadlock on shutdown (#3540)
  • Testing/Process: Fix process Stop timeout error handling (#3523)

🌱 Others

  • LeaderElection: Pass Managers Logger to Leader Elector via Context (#3576)

🌱 CI & linters

  • Add copyright header validation & fix findings (#3544)
  • Bump to golangci-lint v2.12.1 (#3514)
  • Bump to golangci-lint v2.12.2 (#3532)
  • Bump to golangci-lint v2.13.1 (#3580)

... (truncated)

Commits
  • e8f9455 🐛 fakeclient: Allow updating managedFields through Update (#3585)
  • 0cc1315 Merge pull request #3565 from dongjiang1989/fix-leak
  • fa96780 🐛 Fix goroutine leaks in cache Start() methods
  • 1f5514b ✨ Add a read-your-own-write client (#3472)
  • df386c7 🌱 Bump to golangci-lint v2.13.1 (#3580)
  • dc7618f Merge pull request #3583 from pujitha24/auto/issue-3582
  • 37fe235 🐛 fake: fix AddIndex panic when client is wrapped with an interceptor
  • 01c7782 ✨ Allow overriding REST client latency histogram buckets (#3573)
  • 857be80 Merge pull request #3576 from demirdilek/fix-leaderelection-contextual-logging
  • b1387be Merge pull request #3581 from alvaroaleman/fake-consistent
  • Additional commits viewable in compare view

Updates sigs.k8s.io/external-dns from 0.21.0 to 0.22.0

Release notes

Sourced from sigs.k8s.io/external-dns's releases.

v0.22.0

General information

Action required before upgrade

  • ⚠️ The default annotation prefix is now external-dns.kubernetes.io/ with no fallback (#6424)

    • 🚨 This change can delete all your DNS records.
    • ℹ️ You can either migrate your annotations or set --annotation-prefix=external-dns.alpha.kubernetes.io/.
    • ➡️ It's recommended to try this version with --dry-run=true, see recommended upgrade instructions.
    • ⚠️ --dry-run is not preventing changes to happen with ns1, hetzner & alibaba cloud providers

  • ⚠️ To avoid any unwanted DNS records deletion from the annotation prefix change, --policy is now required with no default (#6508).

Important

  • ⚠️ CRD/API upgrades: Gateway API TLSRoute now uses v1, standard channel since Gateway API v1.5.0 (#6367). Ambassador Host now uses getambassador.io/v3alpha1 (#6482). Pi-hole v5 API is removed, v6+ only (#6406).
  • ℹ️ On AWS, ownership TXT records for A ALIAS now use the a- prefix (#6523). Migration is automatic and ownership is preserved
    • Leftover cname- records can be cleaned with scripts/aws-cleanup-legacy-txt-records.py --alias-cname-cleanup.
  • ℹ️ This release removes in-tree support for Akamai, Plural & Transip (#6485).
    • Users needing those providers can use a previous version of ExternalDNS or a webhook-based provider. Gandi is marked for removal (#6634).
  • ℹ️ New: crd registry as an alternative to TXT (#5372)
  • ℹ️ DNAME record support (#6553), and --rfc2136-axfr replacing the deprecated --rfc2136-tsig-axfr (#6598).
  • ℹ️ Guide on how to safely upgrade External-DNS

⚠️ Breaking Changes

🚀 Features

... (truncated)

Changelog

Sourced from sigs.k8s.io/external-dns's changelog.

Release

Release cycle

Currently we don't release regularly. Whenever we think it makes sense to release a new version we do it. You might want to ask in our Slack channel external-dns when the next release will come out.

Staging Release cycle

A new staging image is released weekly and can be found on the official staging registry.

There is a time lag between merging changes into the master branch and the subsequent creation of the staging image.

Example command to fetch 10 most recent staging images:

export EXT_DNS_VERSION="v0.22.0"
curl -sLk https://gcr.io/v2/k8s-staging-external-dns/external-dns/tags/list | jq | grep "$EXT_DNS_VERSION" | tail -n 10

Versioning convention

These are the conventions that we will be using for releases following 0.7.6:

  • Patch version should be updated if we need to merge bugfixes, e.g. provider a does need a fix in order make updates working again. I would see updating or improving documentation here.

  • Minor version should be updated if new features are implemented in existing providers or new provider get introduced.

  • Major version should be upgraded if we introduce breaking changes.

Semantic Versioning Discipline

External-DNS follows semantic versioning principles:

  • 0.x → pre-stable, APIs subject to change.
  • 1.x → not yet considered.

Versioning & Releases External-DNS opts to stay within 0.x versioning scheme. We strive for stability, but reserve the right to introduce breaking changes in minor version bumps when necessary.

How to release a new image

Prerequisite

We use https://github.com/cli/cli to automate the release process. Please install it according to the official documentation.

You must be an official maintainer of the project to be able to do a release.

Steps

... (truncated)

Commits
  • 994f908 bump dependencies for release (#6643)
  • a6ead7c docs(aws): correct hosted zone annotation prefix (#6569)
  • 679a4ce fix(source): parse gloo-proxy aggregateListener virtual hosts (#6628)
  • aa8c1e2 fix(aws): unescape wildcard alias target on read (#6471)
  • 746563e feat: add isSource template function to scope --fqdn-template by source (#6625)
  • 4b9875b fix: pin smartystreets/assertions to resolve go mod tidy failure (#6634)
  • e495d28 bump to go version 1.26.6 (#6635)
  • 6017e85 docs: clarify release tag vs kustomize manifest lag (#6626)
  • 6376edb test(crd): assert the generated CRDs are installable (#6619)
  • eca6bf7 feat: add DNAME record type support (#6553)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(go): Bump the go-dependencies group across 1 directory with 6 u…
2de9c96 
…pdates

Bumps the go-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | `1.21.0` | `1.21.2` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.3` | `0.37.0` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.3` | `0.37.0` |
| [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) | `0.24.1` | `0.25.0` |
| [sigs.k8s.io/external-dns](https://github.com/kubernetes-sigs/external-dns) | `0.21.0` | `0.22.0` |



Updates `github.com/cert-manager/cert-manager` from 1.21.0 to 1.21.2
- [Release notes](https://github.com/cert-manager/cert-manager/releases)
- [Changelog](https://github.com/cert-manager/cert-manager/blob/master/RELEASE.md)
- [Commits](cert-manager/cert-manager@v1.21.0...v1.21.2)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

Updates `k8s.io/apimachinery` from 0.36.3 to 0.37.0
- [Commits](kubernetes/apimachinery@v0.36.3...v0.37.0)

Updates `k8s.io/client-go` from 0.36.3 to 0.37.0
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.3...v0.37.0)

Updates `sigs.k8s.io/controller-runtime` from 0.24.1 to 0.25.0
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.24.1...v0.25.0)

Updates `sigs.k8s.io/external-dns` from 0.21.0 to 0.22.0
- [Release notes](https://github.com/kubernetes-sigs/external-dns/releases)
- [Changelog](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/release.md)
- [Commits](kubernetes-sigs/external-dns@v0.21.0...v0.22.0)

---
updated-dependencies:
- dependency-name: github.com/cert-manager/cert-manager
  dependency-version: 1.21.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: k8s.io/client-go
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: sigs.k8s.io/external-dns
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 17, 2026
@dependabot
dependabot Bot requested a review from borchero as a code owner September 17, 2026 22:41
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 17, 2026
@github-actions github-actions Bot added the build label Sep 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@borchero borchero Awaiting requested review from borchero borchero is a code owner

Assignees

No one assigned

Labels

build dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants