chore(deps): Bump the go-dependencies group across 4 directories with 5 updates

[dependabot]

Bumps the go-dependencies group with 2 updates in the /extensions/backups/backend directory: k8s.io/apimachinery and k8s.io/client-go.
Bumps the go-dependencies group with 2 updates in the /extensions/events/backend directory: k8s.io/apimachinery and k8s.io/client-go.
Bumps the go-dependencies group with 4 updates in the /extensions/networking/backend directory: k8s.io/apimachinery, k8s.io/client-go, github.com/cilium/cilium and google.golang.org/grpc.
Bumps the go-dependencies group with 2 updates in the /extensions/vulnerabilities/backend directory: k8s.io/apimachinery and k8s.io/client-go.

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/api from 0.36.0 to 0.36.1

Commits

• 25001c8 Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates github.com/cilium/cilium from 1.19.3 to 1.19.4

Release notes

Sourced from github.com/cilium/cilium's releases.

1.19.4

Summary of Changes

Minor Changes:

• cilium-agent: when --k8s-service-proxy-name is set, EndpointSlices are now filtered by the service.kubernetes.io/service-proxy-name label at the watch level, matching how Services are already filtered, operators with hand-managed EndpointSlices must stamp the matching label on those slices. (Backport PR cilium/cilium#45755, Upstream PR cilium/cilium#45504, @​HadrienPatte)
• iptables-based masquerading: Ensure iptables rules respect longest prefix match by sorting routes by mask length when enable-masquerade-to-route-source is enabled (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45192, @​liyihuang)
• operator/spire: make SPIRE client configurable for ztunnel (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#44136, @​nddq)
• pkg/endpoint: skip logger rebuild on policy revision updates (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45533, @​sjohnsonpal)

Bugfixes:

• bpf: egressgw: respect egress ifindex during FIB lookup (Backport PR cilium/cilium#45695, Upstream PR cilium/cilium#45661, @​julianwiedmann)
• bpf: host: fix source identity for IPsec trace in to-netdev (Backport PR cilium/cilium#45594, Upstream PR cilium/cilium#45588, @​julianwiedmann)
• cilium-dbg: cilium map list now displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR cilium/cilium#45888, Upstream PR cilium/cilium#44951, @​skymensch)
• cilium: Fix incorrect IPv6 BIG TCP display (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45529, @​pchaigno)
• clustermesh: fails gracefully instead of crashing when EndpointSliceSync is not able to setup the EndpointSlice watch (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45402, @​MrFreezeex)
• clustermesh: Fix Helm typo preventing to add annotations when setting clustermesh.apiserver.tls.auto.method: certmanager (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45576, @​owayss)
• Fix cilium-agent crash when a transient network error occurs during CiliumNode update. The agent now retries instead of calling Fatal. (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#44526, @​nebojsaj1726)
• Fix CiliumLocalRedirectPolicy addressMatcher overriding an existing Service's frontend when its backend pods are not yet Ready. (Backport PR cilium/cilium#45584, Upstream PR cilium/cilium#45522, @​ysksuzuki)
• Fix dedicated Ingress reconciliation panic on invalid TLS passthrough rules (Backport PR cilium/cilium#45888, Upstream PR cilium/cilium#45737, @​weizhoublue)
• Fix host L7 policy operation (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45030, @​atykhyy)
• Fix IPsec packet drops during rolling restart with key rotation by deferring SPI advertisement until XFRM states are ready (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#44701, @​hbangT)
• Fix issue where datapath reinitialization may get stuck when triggered from the local API (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45557, @​jrife)
• Fix missing global service backends in Cluster Mesh when multiple service ports point to the same target port. (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#45179, @​RiccardoAtzori91)
• fix(egressGateway): skip unmatched gateways when using multiple gateway (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#44705, @​ieth0)
• fix(gateway-api): prevent silent disable on CRD discovery timeout (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#44662, @​aslafy-z)
• fix(ipsec): panic in parseSPI on malformed input (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#44815, @​isoyuki)
• Fixed intermittent ARP failures for LoadBalancer services caused by pointer reuse during BPF map iteration in the L2 responder reconciler. (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45197, @​Krishnachaitanyakc)
• Fixed SocketLB returning EPERM instead of EHOSTUNREACH when a Service has no backends. (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45185, @​chez-shanpu)
• Fixes an issue where L7 LoadBalancer and Ingress traffic would be dropped on certain kernel versions when Cilium is attached to a bridge network device. (Backport PR cilium/cilium#45755, Upstream PR cilium/cilium#45582, @​liyihuang)
• Fixes dropped packets on ingress when full header not in linear skb area (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45195, @​javiercardona-work)
• hubble-relay: fix TLS config variable shadowing preventing cleanup on shutdown (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45085, @​Aprazor)
• policy: Fix CCG matching for duplicate label keys (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#45225, @​christarazi)
• Respect backends for BGP only when they are in state: active (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45286, @​CallMeFoxie)
• secretsync recreate synced secret when source secret type changes (Backport PR cilium/cilium#45888, Upstream PR cilium/cilium#45721, @​ssam18)
• wireguard: clamp cilium_wg0 MTU to IPV6_MIN_MTU (1280) when IPv6 is enabled, preventing silent packet loss in tunnel+encryption mode with constrained path MTU (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45425, @​tibrezus)

CI Changes:

• .github/workflows: skip full test suite for workflow_dispatch on dev … (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#45285, @​aanm)
• complexity-diff: Small improvements (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45556, @​pchaigno)
• contrib: fix typo in identity_is_node.cocci (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45505, @​julianwiedmann)
• datapath/loader: Add map count to verifier complexity records (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#44652, @​dylandreimerink)
• gha/clustermesh: use OCI registry for cert-manager (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#45326, @​giorio94)
• logging: Update leader election log level override (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45358, @​joamaki)
• Use extra power github runner if available for multi-pool CI workflow (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45555, @​fristonio)

Misc Changes:

• cilium/cilium#45935@​ferozsalam)
• Add documentation and warnings on DNS interception (Backport PR cilium/cilium#45888, Upstream PR cilium/cilium#45525, @​ferozsalam)
• cilium/cilium#45462@​cilium-renovate[bot])

... (truncated)

Changelog

Sourced from github.com/cilium/cilium's changelog.

v1.19.4

Summary of Changes

Minor Changes:

• cilium-agent: when --k8s-service-proxy-name is set, EndpointSlices are now filtered by the service.kubernetes.io/service-proxy-name label at the watch level, matching how Services are already filtered, operators with hand-managed EndpointSlices must stamp the matching label on those slices. (Backport PR cilium/cilium#45755, Upstream PR cilium/cilium#45504, @​HadrienPatte)
• iptables-based masquerading: Ensure iptables rules respect longest prefix match by sorting routes by mask length when enable-masquerade-to-route-source is enabled (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45192, @​liyihuang)
• operator/spire: make SPIRE client configurable for ztunnel (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#44136, @​nddq)
• pkg/endpoint: skip logger rebuild on policy revision updates (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45533, @​sjohnsonpal)

Bugfixes:

• bpf: egressgw: respect egress ifindex during FIB lookup (Backport PR cilium/cilium#45695, Upstream PR cilium/cilium#45661, @​julianwiedmann)
• bpf: host: fix source identity for IPsec trace in to-netdev (Backport PR cilium/cilium#45594, Upstream PR cilium/cilium#45588, @​julianwiedmann)
• cilium-dbg: cilium map list now displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR cilium/cilium#45888, Upstream PR cilium/cilium#44951, @​skymensch)
• cilium: Fix incorrect IPv6 BIG TCP display (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45529, @​pchaigno)
• clustermesh: fails gracefully instead of crashing when EndpointSliceSync is not able to setup the EndpointSlice watch (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45402, @​MrFreezeex)
• clustermesh: Fix Helm typo preventing to add annotations when setting clustermesh.apiserver.tls.auto.method: certmanager (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45576, @​owayss)
• Fix cilium-agent crash when a transient network error occurs during CiliumNode update. The agent now retries instead of calling Fatal. (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#44526, @​nebojsaj1726)
• Fix CiliumLocalRedirectPolicy addressMatcher overriding an existing Service's frontend when its backend pods are not yet Ready. (Backport PR cilium/cilium#45584, Upstream PR cilium/cilium#45522, @​ysksuzuki)
• Fix dedicated Ingress reconciliation panic on invalid TLS passthrough rules (Backport PR cilium/cilium#45888, Upstream PR cilium/cilium#45737, @​weizhoublue)
• Fix host L7 policy operation (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45030, @​atykhyy)
• Fix IPsec packet drops during rolling restart with key rotation by deferring SPI advertisement until XFRM states are ready (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#44701, @​hbangT)
• Fix issue where datapath reinitialization may get stuck when triggered from the local API (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45557, @​jrife)
• Fix missing global service backends in Cluster Mesh when multiple service ports point to the same target port. (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#45179, @​RiccardoAtzori91)
• fix(egressGateway): skip unmatched gateways when using multiple gateway (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#44705, @​ieth0)
• fix(gateway-api): prevent silent disable on CRD discovery timeout (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#44662, @​aslafy-z)
• fix(ipsec): panic in parseSPI on malformed input (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#44815, @​isoyuki)
• Fixed intermittent ARP failures for LoadBalancer services caused by pointer reuse during BPF map iteration in the L2 responder reconciler. (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45197, @​Krishnachaitanyakc)
• Fixed SocketLB returning EPERM instead of EHOSTUNREACH when a Service has no backends. (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45185, @​chez-shanpu)
• Fixes an issue where L7 LoadBalancer and Ingress traffic would be dropped on certain kernel versions when Cilium is attached to a bridge network device. (Backport PR cilium/cilium#45755, Upstream PR cilium/cilium#45582, @​liyihuang)
• Fixes dropped packets on ingress when full header not in linear skb area (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45195, @​javiercardona-work)
• hubble-relay: fix TLS config variable shadowing preventing cleanup on shutdown (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45085, @​Aprazor)
• policy: Fix CCG matching for duplicate label keys (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#45225, @​christarazi)
• Respect backends for BGP only when they are in state: active (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45286, @​CallMeFoxie)
• secretsync recreate synced secret when source secret type changes (Backport PR cilium/cilium#45888, Upstream PR cilium/cilium#45721, @​ssam18)
• wireguard: clamp cilium_wg0 MTU to IPV6_MIN_MTU (1280) when IPv6 is enabled, preventing silent packet loss in tunnel+encryption mode with constrained path MTU (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45425, @​tibrezus)

CI Changes:

• .github/workflows: skip full test suite for workflow_dispatch on dev … (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#45285, @​aanm)
• complexity-diff: Small improvements (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45556, @​pchaigno)
• contrib: fix typo in identity_is_node.cocci (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45505, @​julianwiedmann)
• datapath/loader: Add map count to verifier complexity records (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#44652, @​dylandreimerink)
• gha/clustermesh: use OCI registry for cert-manager (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#45326, @​giorio94)
• logging: Update leader election log level override (Backport PR cilium/cilium#45496, Upstream PR cilium/cilium#45358, @​joamaki)
• Use extra power github runner if available for multi-pool CI workflow (Backport PR cilium/cilium#45673, Upstream PR cilium/cilium#45555, @​fristonio)

Misc Changes:

• cilium/cilium#45935@​ferozsalam)
• Add documentation and warnings on DNS interception (Backport PR cilium/cilium#45888, Upstream PR cilium/cilium#45525, @​ferozsalam)

... (truncated)

Commits

• 95e477f Prepare for release v1.19.4
• c26459e Bump x/net to v0.53
• 10f57cf chore(deps): update quay.io/cilium/cilium-envoy
• 0605613 images: update cilium-{runtime,builder}
• a8783b8 chore(deps): update base-images to v1.25.10
• 0953554 Add documentation and warnings on DNS interception
• 8852fc3 Fix dedicated Ingress reconciliation panic on invalid TLS passthrough rules
• 70cc82e cilium-dbg: show "unknown" entry count for maps without cache
• 8d7c4e5 docs: add small CiliumCIDRGroup scalability callout
• 8c506f5 hive/health: return error if no status found for health tree cmd filter
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.80.0 to 1.81.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.81.1

Security

• xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per gRFC A41. (#9111)
  • Special Thanks: @​al4an444

Bug Fixes

• otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (#9081)

Release 1.81.0

Behavior Changes

• balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (#8808)

Dependencies

• Minimum supported Go version is now 1.25. (#8969)

Bug Fixes

• xds: Use the leaf cluster's security config for the TLS handshake instead of the aggregate cluster's config. (#8956)
• transport: Send a RST_STREAM when receiving an END_STREAM when the stream is not already half-closed. (#8832)
• xds: Fix ADS resource name validation to prevent a panic. (#8970)

New Features

• grpc/stats: Add support for custom labels in per-call metrics (gRFC A108). (#9008)
• xds: Add support for Server Name Indication (SNI) and SAN validation (gRFC A101). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_SNI=true environment variable. (#9016)
• xds: Add support to control which fields get propagated from ORCA backend metric reports to LRS load reports (gRFC A85). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION=true. (#9005)
• xds: Add metrics to track xDS client connectivity and cached resource state (gRFC A78). (#8807)
• stats/otel: Enhance grpc.subchannel.disconnections metric by adding disconnection reason to the grpc.disconnect_error label (gRFC A94). This provides granular insights into why subchannels are closing. (#8973)
• mem: Add mem.Buffer.Slice() API to slice the buffer like a slice. (#8977)
  • Special Thanks: @​ash2k

Performance Improvements

• alts: Pool read buffers to lower memory utilization when sockets are unreadable. (#8964)
• transport: Pool HTTP/2 framer read buffers to reduce idle memory consumption. Currently limited to Linux for ALTS and non-encrypted transports (TCP, Unix). To disable, set GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING=false and report any issues. (#9032)

Commits

• caf0772 Change version from 1.81.1-dev to 1.81.1 (#9122)
• 6ccbeeb Cherry-pick #9111 into v1.81.x (#9121)
• b33c29e Cherry-pick #9081 into v1.81.x (#9102)
• c45fae6 Change version to 1.81.1-dev (#9063)
• cb18228 Change version to 1.81.0 (#9062)
• 96748f9 Cherry-pick #9105 to 1.81.x (#9106)
• 9183222 Cherry pick #9055, #9032 to v1.81.x (#9095)
• 5cba6da Revert "deps: update dependencies for all modules (#9065)" (#9067)
• af8a936 deps: update dependencies for all modules (#9065)
• cdc60df transport: optimize heap allocations in ready reader and update syscall conne...
• Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.0 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• See full diff in compare view

Updates k8s.io/client-go from 0.36.0 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• See full diff in compare view