Bump the global group across 1 directory with 6 updates

[dependabot]

Bumps the global group with 4 updates in the / directory: github.com/onsi/ginkgo/v2, k8s.io/api, k8s.io/client-go and sigs.k8s.io/controller-runtime.

Updates github.com/onsi/ginkgo/v2 from 2.28.2 to 2.29.0

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.29.0

2.29.0

GinkgoHelperGo makes it easier to write test helpers that need to run in goroutines. Specifically, it makes managing the failure state and capturing failure panics correctly straightforward.

ginkgo outline now includes entries defined in DescribeTableSubtree

v2.28.3

2.28.3

Maintenance

Bump all dependencies

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.29.0

GinkgoHelperGo makes it easier to write test helpers that need to run in goroutines. Specifically, it makes managing the failure state and capturing failure panics correctly straightforward.

ginkgo outline now includes entries defined in DescribeTableSubtree

2.28.3

Maintenance

Bump all dependencies

Commits

• 04b5bcb v2.29.0
• 124232a docs: GinkgoHelperGo
• ad9cee8 feat: GinkgoHelperGo, with integration tests
• 9e56a0a chore: refactor devcontainer for better maintenance
• 3d235a9 chore: ignore internal/tmp_*/ integration suite temporary dirs
• 782666a feat: devcontainer configuration with local pkgsite and GH pages
• 009dd04 Support DescribeTableSubtree in ginkgo outline
• 5de9c15 v2.28.3
• 7e2fa19 bump dependencies
• See full diff in compare view

Updates github.com/onsi/gomega from 1.39.0 to 1.40.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.40.0

1.40.0

We're adopting a new release strategy to minimize dependency bloat in projects that consume Gomega. It is a limitation of the go mod toolchain that test subdependencies of your project's direct dependencies get pulled in as indirect dependencies. In the case of Gomega, this ends up pulling in all of Ginkgo into your go.mod even if you are only using Gomega (Gomega uses Ginkgo for its own tests).

Going forward, releases will strip out all tests, tidy up the go.mod and then push this stripped down version to a new master-lite branch. These stripped-down versions will receive the vx.y.z git tag and will be picked up by the go toolchain.

Please open an issue if this new release process causes unexpected changes for your projects.

v1.39.1

1.39.1

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.40.0

We're adopting a new release strategy to minimize dependency bloat in projects that consume Gomega. It is a limitation of the go mod toolchain that test subdependencies of your project's direct dependencies get pulled in as indirect dependencies. In the case of Gomega, this ends up pulling in all of Ginkgo into your go.mod even if you are only using Gomega (Gomega uses Ginkgo for its own tests).

Going forward, releases will strip out all tests, tidy up the go.mod and then push this stripped down version to a new master-lite branch. These stripped-down versions will receive the vx.y.z git tag and will be picked up by the go toolchain.

Please open an issue if this new release process causes unexpected changes for your projects.

1.39.1

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

Commits

• 87ee9d3 v1.40.0
• ea66027 v1.40.0 (full)
• e3fd789 update docs to reflect new versioning strategy
• 7d4ee30 first push to master-lite
• e4a82d1 Bump github/codeql-action from 3 to 4 (#875)
• af62723 Bump rexml from 3.4.0 to 3.4.2 in /docs (#870)
• e164221 Bump github.com/onsi/ginkgo/v2 from 2.28.0 to 2.28.1 (#895)
• 334a282 Bump faraday from 2.12.2 to 2.14.1 in /docs (#896)
• 1a25a36 v1.39.1
• 406faee bump all deps
• See full diff in compare view

Updates k8s.io/api from 0.36.0 to 0.36.1

Commits

• 25001c8 Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.24.1

What's Changed

• [release-0.24] 🐛 Fix regression in Apply typed error handling by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3516

Full Changelog: kubernetes-sigs/controller-runtime@v0.24.0...v0.24.1

Commits

• 3be3f1b Merge pull request #3516 from k8s-infra-cherrypick-robot/cherry-pick-3515-to-...
• 0f7b33d Fix regression in Apply typed error handling
• See full diff in compare view

---

Note

Medium Risk
Patch bumps to Kubernetes client-go and controller-runtime can affect reconciliation and server-side apply behavior even without code edits; validate tests and reconcile paths after merge.

Overview
This PR only refreshes Go module dependencies in go.mod and go.sum; there are no application or controller code changes.

Direct bumps: github.com/onsi/ginkgo/v2 (2.28.2 → 2.29.0), github.com/onsi/gomega (1.39.0 → 1.40.0), k8s.io/api, k8s.io/apimachinery, and k8s.io/client-go (0.36.0 → 0.36.1), and sigs.k8s.io/controller-runtime (0.24.0 → 0.24.1). The lockfile also picks up assorted indirect updates (e.g. go-openapi/swag, golang.org/x/*, k8s.io/utils, k8s.io/kube-openapi, sigs.k8s.io/structured-merge-diff).

The controller-runtime patch is notable for this repo because reconcilers use server-side client.Apply via serverSideApply in internal/controller/common/kube/reconcilers.go; v0.24.1 includes a fix for a regression in Apply typed error handling.

^{Reviewed by Cursor Bugbot for commit d013d2a. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Labels

The following labels could not be found: Changed, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​onsi/​gomega@​v1.39.0 ⏵ v1.40.0	+2
	sigs.k8s.io/​controller-runtime@​v0.24.0 ⏵ v0.24.1	+1
	k8s.io/​apimachinery@​v0.36.0 ⏵ v0.36.1
	k8s.io/​client-go@​v0.36.0 ⏵ v0.36.1
	k8s.io/​api@​v0.36.0 ⏵ v0.36.1
	github.com/​onsi/​ginkgo/​v2@​v2.28.2 ⏵ v2.29.0	+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report