Repository navigation
chore(deps): update all dependencies - #227
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/all
branch
4 times, most recently
from
September 24, 2026 21:47
4daa517 to
5e7c84c
Compare
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
Bot
force-pushed
the
renovate/all
branch
6 times, most recently
from
October 5, 2026 19:10
3957605 to
8e3e40a
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
9 times, most recently
from
October 15, 2026 04:22
4324d78 to
9d8712e
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
6 times, most recently
from
October 22, 2026 17:13
7dbeead to
37c4857
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
3 times, most recently
from
October 23, 2026 23:49
6c02585 to
f2cdf04
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
6 times, most recently
from
October 31, 2026 22:51
c919e3d to
8de11be
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
5 times, most recently
from
November 6, 2026 08:52
7fb4aaf to
085f011
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
from
November 7, 2026 03:12
085f011 to
fa8d725
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
1.21.2→1.21.3e2e927e→25ac8f0v2.32.2→v2.34.0v1.43.0→v1.44.0v0.159.0→v0.162.0v1.24.1→v1.25.0v1.67.0→v1.71.0v1.67.0→v1.71.0v1.67.0→v1.71.0v1.67.0→v1.71.0v0.161.0→v0.165.0v0.161.0→v0.165.0v1.67.0→v1.71.0v0.161.0→v0.165.01.27.1-alpine3.23→1.27.3-alpine3.232.13.2→2.15.0v0.37.0→v0.37.2v0.37.0→v0.37.2v0.37.0→v0.37.20.22.0→0.23.00.159.0→0.162.00.123.0→0.129.0v0.25.1→v0.25.2Release Notes
cert-manager/cert-manager
v1.21.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.21.3 removes trust in the compromised eMudhra CA (see eMudhra Compromise). The updated base images no longer include the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes
crypto/x509reject certificate chains that pass through the compromised intermediates (CVE-2026-111943).It also fixes an ACME ARI renewal loop, stops the controller copying a private key from a Secret that the Certificate does not own, and quotes the proxy values in the Helm chart. It updates Go and several dependencies to fix reported security vulnerabilities.
All users should upgrade.
Changes by Kind
Bug or Regression
status.acme.ari.certIDto track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. (#9292, @hjoshi123)http_proxy,https_proxyandno_proxyvalues when rendering the controller Deployment env vars, so values like*.example.comno longer break the manifest. (#9407, @pujitha24)requestmanagerandissuingcontrollers now only consume the Secret named bystatus.nextPrivateKeySecretNamewhen it carries thecert-manager.io/next-private-keylabel and is owned by the Certificate, matching the invariant thekeymanagercontroller already enforces. Previously a principal able to write thecertificates/statussubresource, but not to read Secrets, could name any Secret in the namespace and have its private key copied intospec.secretName. Thekeymanagercontroller no longer creates the next private key Secret under the name instatus.nextPrivateKeySecretName. It always uses a generated name, records aNotOwnedWarning event when the field names a Secret it does not own, and repoints the field at the Secret it owns rather than deleting that Secret when the two disagree. The Secret named byspec.secretNameis never treated as a next private key Secret, even ifspec.secretTemplatelabels it as one. (#9368, @wallrj)Other (Cleanup or Flake)
golang.org/x/netto v0.60.0 to fix reported security vulnerabilities (#9451)go.opentelemetry.io/otel/exporters/otlp/otlptraceandotlptracegrpcto v1.45.0 to fix a reported security vulnerability (#9374, #9375)onsi/ginkgo (github.com/onsi/ginkgo/v2)
v2.34.0Compare Source
Features
DeferOnFailureregisters a callback that runs only when a spec fails - as soon as the failing node returns and before any teardown (JustAfterEach,AfterEach,AfterAll,DeferCleanup) - so it can capture the state teardown is about to destroy. It takes exactly whatDeferCleanuptakes and shares its scoping: called inBeforeEach/JustBeforeEach/Itit covers the spec, inBeforeAllthe ordered container, and inBeforeSuitethe whole suite. It is also available onGinkgoT(); note that this adds a method toFullGinkgoTInterface, so hand-written implementations of that interface need to add it. See https://onsi.github.io/ginkgo/#capturing-failure-state-deferonfailureFixes
AttachProgressReporter) are no longer called while Ginkgo holds an internal lock, so a reporter that callsCurrentSpecReport()orAddReportEntry()no longer stalls for 5 seconds and has its output dropped.--sleep-on-failurenow runs after anyDeferOnFailurecallbacks, also pauses when a spec times out, and no longer pauses if the suite has already been interrupted.v2.33.1Compare Source
Fixes
v2.33.0Compare Source
Features
ReportEntrys as<properties>on its<testcase>element, with the entry's name and its JSON-encoded value. Thanks @pohly! [23db51a]Maintenance
## Unreleasedas the work happens. See RELEASING.md. [8616ecb]onsi/gomega (github.com/onsi/gomega)
v1.44.0Compare Source
Fixes
BeNumericallycompares signed and unsigned integers by value:-1no longer equalsuint64(math.MaxUint64)anduint(5)is now greater than-3(#925) [26e3c6b]BeNumerically("~")no longer overflows when computing the distance between extreme integers (#928) [1955764]BeNumerically("==", x, threshold)now honors the threshold for floats, as it already did for integers (#927) [10e2aca]HaveKeyWithValuesucceeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]HaveKeyandHaveKeyWithValuetreat key and value matcher errors likeContainElementdoes: a match wins, and an error is only reported when nothing matches (#926) [dc91598]MatchJSONno longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]MatchJSONcompares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7,630fe12]HaveExactElementsreports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]MatchYAMLcompares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing---) are ignored (#933) [2773796]MatchXMLignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89,2565350]v1.43.1Compare Source
Maintenance
d547015]## Unreleasedas the work happens. Releases still ship the stripped-down tree onmaster-lite- tests removed and Ginkgo dropped fromgo.mod- and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]open-telemetry/opentelemetry-operator (github.com/open-telemetry/opentelemetry-operator/apis)
v0.162.0Compare Source
0.162.0
🛑 Breaking changes 🛑
auto-instrumentation: Block automatic NodeJS instrumentation upgrades across 0.79.0 because of breaking HTTP, network, and database semantic convention changes. (#2542)To upgrade, manually set spec.nodejs.image to an image using instrumentation 0.79.0 or higher. See #2542 for migration details.
🚀 New components 🚀
auto-instrumentation: Add support for auto-instrumentation in PHP applications. (#932)Auto-instrumentation in PHP applications is disabled by default in operator. Users can enable it by setting the
--enable-php-instrumentationorENABLE_PHP_AUTO_INSTRUMENTATIONenvironment variable totruein operatorand setting up the annotations
instrumentation.opentelemetry.io/inject-phpandinstrumentation.opentelemetry.io/otel-php-api-version.For more information, please refer to the documentation.
auto-instrumentation: Add initial version of autoinstrumentation for ruby (#3762)Ruby auto-instrumentation is disabled by default. Enable it with
--enable-ruby-instrumentation=true.💡 Enhancements 💡
collector: Inject the cluster TLS profile's supported groups ascurve_preferencesinto generated collector configurations. (#6893)Receivers and extensions with a
tlsblock inspec.confignow getcurve_preferencesdefaulted from thecluster's TLS security profile
groups, following the same defaults-only rule asmin_versionandcipher_suites: values set by the user are never overridden.Groups without a collector
curve_preferencesspelling are logged at operator startup and not injected.🧰 Bug fixes 🧰
operator, target allocator, opamp, auto-instrumentation: Remove the distrusted emSign root CAs from the operator, target allocator, OpAMP bridge, and Python auto-instrumentation images. (#5802)The operator, target allocator, and OpAMP bridge images require Alpine
ca-certificates2026102-r0 or later.The Python auto-instrumentation image requires
certifi2026.10.19 or later and is published as0.66b1-3.The updated CA bundle removes the distrusted eMudhra emSign roots, including
emSign ECC Root CA - G3.Images are built with Go 1.27.3, which includes the
crypto/x509security fixes released on 2026-10-19.collector: Include the requesting user's UID and extra fields in the SubjectAccessReviews used to check RBAC privilege escalation. (#5659)Authorizers that rely on these fields, such as AKS with Azure RBAC for Kubernetes Authorization, denied the check
for users who held the required permissions.
collector, target allocator: Use pointer for TargetAllocator Telemetry field so omitempty works correctly with encoding/json (#5695)Go's encoding/json does not omit zero-value structs with omitempty. The non-pointer
TelemetryConfig field caused targetAllocator.telemetry to always be serialized during
server-side apply, even when not set, breaking consumers that use a CRD version without
this field.
collector: Keepservice.telemetryunchanged when the operator cannot parse it, instead of replacing it with the default Prometheus reader. (#5734)The collector accepts telemetry settings the operator does not parse, such as
resource.attributes.Such a configuration now gets an admission warning, and no default metrics reader is added to it.
Components
v0.161.0Compare Source
0.161.0
🛑 Breaking changes 🛑
opamp: Use the Kubernetes cluster ID to compute standalone OpAMP Bridge agent instance IDs. (#5689)collector: Remove the deprecated--create-rbac-permissionsCLI flag. RBAC permission creation is now exclusively autodetected at startup. (#2588)The flag was deprecated in v0.88.0. The operator now always autodetects whether its service account can create ClusterRoles and ClusterRoleBindings.
💡 Enhancements 💡
collector: AddrevisionHistoryLimitfield to OpenTelemetryCommonFields to control the number of old ReplicaSets retained for Deployment and StatefulSet workloads, and for the TargetAllocator Deployment. (#0)collector: Skip the automaticGOMEMLIMITandGOMAXPROCSenvironment variables when the collector config enables thecgroup_runtimeextension. (#5651)The extension sets both variables from the cgroup limits and does nothing when they are already present.
The deprecated
cgroupruntimetype name is recognized as well.Each variable is skipped only while its
gomemlimit.enabledorgomaxprocs.enabledsetting is true.collector, target allocator: AddimagePullSecretsto the OpenTelemetryCollector and TargetAllocator CRs, passed through to the pod spec of the generated workloads. A target allocator embedded in an OpenTelemetryCollector uses the collector'simagePullSecrets. (#4376)collector: Register thewebhook_eventreceiver (aliaswebhookevent) so the operator derives its Service port fromendpoint, which the receiver requires, and rejects a configuration that omits it. (#5631)🧰 Bug fixes 🧰
collector: Fix the collector defaulting webhook panicking whenreceiversorexportersis missing. (#5735)The request is now rejected by CRD validation, as it already was when no component defaults apply.
target allocator: Honor the cumulative temporality preference for counters bridged from the Prometheus registry in OTLP self-telemetry. (#5700)Bridged counters, such as the Prometheus service discovery metrics, were converted to delta regardless of
temporality_preference. They are now converted only when the preference selects delta for counters(
deltaorlow_memory), and are exported as cumulative otherwise.target allocator: Keep the Kubernetes API server addresses in the target allocator NetworkPolicy up to date. (#5551)The operator now watches the EndpointSlices of the
default/kubernetesService and updates the target allocatorNetworkPolicy when they change, instead of using the addresses discovered once at operator startup.
Addresses which disappear from the EndpointSlices remain allowed for 5 minutes, to tolerate transient changes.
The NetworkPolicy also allows egress to the
kubernetesService ClusterIP, and uses correct CIDRs for IPv6 addresses.The operator now requires the
watchpermission onendpointslicesin thediscovery.k8s.ioAPI group.operator: Fix the--tls-min-versionCLI flag being ignored because it was matched against the wrong flag name. (#3565)sidecar: Prevent sidecar injection into invalid pods with zero regular containers (#5737)Pods without containers are invalid in Kubernetes. Skipping injection allows Kubernetes to reject the invalid Pod rather than mutating it into a valid one.
Components
v0.160.0Compare Source
0.160.0
🛑 Breaking changes 🛑
operator, collector, target allocator: Disable operator, collector, and target allocator network policies by default. (#5551, #5558, #5621, #5624, #5654)The
operator.networkpolicyandoperand.networkpolicyfeature gates are moved back to alpha and are disabled by default.The generated network policies can block API server access on some clusters.
To keep creating network policies, enable them with
--feature-gates=+operator.networkpolicy,+operand.networkpolicy,or set
spec.networkPolicy.enabled: trueon individual collectors and target allocators.🚩 Deprecations 🚩
auto-instrumentation: Remove autoinstrumentation-php image definition from the repository (#932)The PHP autoinstrumentation image will be hosted by the packaging SIG.
The one released image (v0.1.0) of the image in the operator registry will
eventually be deleted. This image was never used for any functionality shipped by the operator.
💡 Enhancements 💡
collector: Add RBAC support for extracting labels and annotations from CronJobs (and Jobs) via thek8sattributesprocessor. (#5527)The operator's own ServiceAccount must itself hold
get/list/watchonbatch/jobsandbatch/cronjobsfor this to take effect, since Kubernetes RBAC only lets a ServiceAccountgrant permissions it already has. This PR also extends the operator's own ClusterRole
accordingly (
config/rbac/role.yaml).collector, target allocator: AddenableServiceLinksto the OpenTelemetryCollector and TargetAllocator CRs, passed through to the pod spec of the generated workloads. It defaults to true, matching the Kubernetes Pod field. (#5569)operator: Add support for Kubernetes 1.37 (#5650)🧰 Bug fixes 🧰
auto-instrumentation: Honor Instrumentation CRD/API json tags when loading--config-file(no-CRD webhook configs). (#5618)Operator Config fields still load with gopkg.in/yaml.v3 (yaml tags). The
instrumentationsblock is re-parsed with sigs.k8s.io/yaml so embedded APItypes keep their json tags (for example
apacheHttpd,imagePullPolicy,resourceAttributes,valueFrom,volumeLimitSize,configPath).collector: Preserve TCP and UDP protocols when generating NetworkPolicy ports. (#5611)target allocator: Use the.svcFQDN for the TargetAllocator endpoint injected into the collector's Prometheus receiver so it works on clusters behind an HTTP proxy. (#5586)The bare service name (http://-targetallocator:80) does not match the standard NO_PROXY
entries (.svc, .cluster.local), so Go routes the request through the proxy. Using
-targetallocator..svc matches NO_PROXY=.svc while staying compatible with
custom cluster domains (unlike the full .svc.cluster.local endpoint reverted in #3248).
target allocator: Restorepromhttp_metric_handler_requests_totalandpromhttp_metric_handler_requests_in_flighton the/metricsendpoint when a custom gatherer is configured. (#5622)#5294switched the/metricshandler topromhttp.HandlerForwhen a custom gathereris set, but omitted the
InstrumentMetricHandlerwrapper that registers these two metrics.The handler is now built once in
NewServer(after options are applied) usingInstrumentMetricHandler, restoring the missing metrics for both code paths.target allocator: Watch and prune all the resources the TargetAllocator controller creates. (#5657)The controller now watches the resources it creates, so manual changes to them are reverted.
It also deletes the resources it no longer needs, for example the NetworkPolicy after
spec.networkPolicy.enabledis set to false, or the ServiceMonitor afterspec.observability.metrics.enableMetricsis set to false.collector: Fix string values that look like numbers, booleans, timestamps or special floats (e.g."0e12",".inf") being written unquoted to the collector ConfigMap, which made the collector read them as a different type and fail to start. (#4314)The ConfigMap is now rendered with the same YAML library the collector parses it with (
go.yaml.in/yaml/v3),and the rendered document is checked to decode back to the values held by the CR before it is written.
The target allocator rewrite of the Prometheus receiver no longer re-parses the rendered config, and the
resulting ConfigMap uses the same formatting as configs without a target allocator (2-space indentation).
collector: Detect Gateway API availability by theHTTPRoutekind served ingateway.networking.k8s.io/v1instead of the API group alone, so the operator no longer crash-loops on clusters with a partial Gateway API bundle (for example onlyGatewayClass). (#5571)target allocator: Stop assigning targets to collector pods that are being deleted. A terminating pod keeps reporting Ready until the kubelet confirms the deletion, which never happens while its node is unreachable, so its targets were never reassigned. (#5576)webhook: Configure the standalone OpenShift webhook with the environment variables required for cert-manager autodetection. (#5660)This allows TargetAllocator mTLS admission to discover cert-manager when the webhook is
installed through the OpenShift/OLM deployment path.
opamp: Only require workload patch permissions when the AcceptsRestartCommand capability is enabled, and reject restart commands when it is not. (#5573)Components
prometheus/client_golang (github.com/prometheus/client_golang)
v1.25.0Compare Source
api/prometheus/v1(see the [CHANGE] entries below).1.25.0 / 2026-10-07
Query,QueryRange,Series,LabelNames, andLabelValuesnow returnInfosannotations in addition toWarnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and ofapi.Client'sDo/DoGetFallback; custom API client implementations must be updated. #1963TSDBBlocksresult types to align with the Prometheus server'stsdb.BlockMeta:TSDBBlocksResultnow containsBlocks []TSDBBlockMetadirectly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta,TSDBBlockStats,TSDBBlockMetaCompaction), stat fields areuint64withomitemptytags, and the optional compactionparentsfield is included. #1928GatherAndFormatto encode a subset of metrics from a Gatherer. #2091HandlerOpts.AcceptedFormatsto customize the formats negotiated from the incomingAcceptheader, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146Varyheader. #2142GatherAndFormatandCollectAndFormat(terminating# EOF). #2125:fooargument no longer substitutes inside:foobar. #2136What's changed
What's Changed
Configuration
📅 Schedule: (in timezone Etc/UTC)
* 0-3 * * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.