Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 14 updates - #554

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/operator/minor-and-patch-2c9f138c06
Open

build(deps): bump the minor-and-patch group across 1 directory with 14 updates#554
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/operator/minor-and-patch-2c9f138c06

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 14 updates in the /operator directory:

Package From To
github.com/cert-manager/cert-manager 1.21.1 1.21.3
github.com/go-chi/chi/v5 5.3.0 5.5.0
github.com/gowebpki/jcs 1.0.1 1.0.2
github.com/onsi/ginkgo/v2 2.32.1 2.33.1
github.com/onsi/gomega 1.42.1 1.44.0
github.com/prometheus/client_golang 1.24.1 1.25.0
github.com/prometheus/client_model 0.6.2 0.6.3
github.com/sigstore/sigstore-go 1.3.0 1.4.0
github.com/spiffe/go-spiffe/v2 2.8.1 2.8.2
golang.org/x/sync 0.23.0 0.24.0
k8s.io/apiextensions-apiserver 0.36.3 0.37.2
k8s.io/apimachinery 0.36.3 0.37.2
k8s.io/client-go 0.36.3 0.37.2
sigs.k8s.io/controller-runtime 0.24.1 0.25.2

Updates github.com/cert-manager/cert-manager from 1.21.1 to 1.21.3

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.21.3

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.3 removes trust in the compromised eMudhra CA (see eMudhra Compromise). The updated base images no longer include the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes crypto/x509 reject certificate chains that pass through the compromised intermediates (CVE-2026-111943).

It also fixes an ACME ARI renewal loop, stops the controller copying a private key from a Secret that the Certificate does not own, and quotes the proxy values in the Helm chart. It updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

  • Added status.acme.ari.certID to track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. (#9292, @​hjoshi123)
  • Helm chart: quote the http_proxy, https_proxy and no_proxy values when rendering the controller Deployment env vars, so values like *.example.com no longer break the manifest. (#9407, @​pujitha24)
  • The requestmanager and issuing controllers now only consume the Secret named by status.nextPrivateKeySecretName when it carries the cert-manager.io/next-private-key label and is owned by the Certificate, matching the invariant the keymanager controller already enforces. Previously a principal able to write the certificates/status subresource, but not to read Secrets, could name any Secret in the namespace and have its private key copied into spec.secretName. The keymanager controller no longer creates the next private key Secret under the name in status.nextPrivateKeySecretName. It always uses a generated name, records a NotOwned Warning event when the field names a Secret it does not own, and repoints the field at the Secret it owns rather than deleting that Secret when the two disagree. The Secret named by spec.secretName is never treated as a next private key Secret, even if spec.secretTemplate labels it as one. (#9368, @​wallrj)

Other (Cleanup or Flake)

  • Upgrade Go to 1.26.9, fixing CVEs in the crypto/tls, net/http, net/textproto and html/template packages. (#9444, @​wallrj-cyberark)
  • Upgrade Go to 1.26.10, fixing a CVE in the crypto/x509 package. (#9501, @​wallrj-cyberark)
  • Bump golang.org/x/net to v0.60.0 to fix reported security vulnerabilities (#9451)
  • Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace and otlptracegrpc to v1.45.0 to fix a reported security vulnerability (#9374, #9375)
  • Update distroless base images, removing the compromised "emSign ECC Root CA - G3" root certificate (#9351, #9414, #9493, #9495)

v1.21.2

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

  • ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#9239, @​FelixPhipps)
  • Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#9222, @​FelixPhipps)
  • De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#9234, @​speer)
  • Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#9240, @​wieghx)
  • Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#9235, @​lunarwhite)
  • Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#9278, @​arpitjain099)
  • Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#9236, @​hjoshi123)
  • Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#9313, @​shashankvarma499)
  • Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#9238, @​thc1006)
  • Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#9312, @​shashankvarma499)
  • Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#9262, @​FelixPhipps)
  • Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#9314, @​KR-Ravindra)
  • The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#9232, @​FelixPhipps)
  • The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#9231, @​FelixPhipps)

... (truncated)

Commits
  • 925c222 Merge pull request #9501 from wallrj-cyberark/release-1.21-go-1.26.10
  • cfd6d18 Update vendored Go to 1.26.10
  • c6746d7 Merge pull request #9495 from cert-manager/renovate/release-1.21-base-images
  • a3ee670 chore(deps): update base images
  • b3e26fb Merge pull request #9493 from cert-manager/renovate/release-1.21-base-images
  • 6da0bf8 chore(deps): update base images
  • 7c32f61 Merge pull request #9475 from cert-manager-bot/cherry-pick-9464-to-release-1.21
  • 9d05ba7 Merge pull request #9474 from cert-manager-bot/cherry-pick-9467-to-release-1.21
  • c7fef37 test(e2e): use local DNS zone for ACME webhook test
  • 614e382 fixing ci tests with change in bind image
  • Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.3.0 to 5.5.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.5.0

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.4.0...v5.5.0

v5.4.0

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

v5.3.2

What's Changed

... (truncated)

Commits
  • 3a33ba5 middleware: SupressNotFound must not mutate the request's route context (#1220)
  • 6075570 middleware: parse quoted ContentCharset media parameters (#1218)
  • 46295d0 middleware: test Retry-After rounding in one table test (#1217)
  • c6e33a1 middleware: build Maybe handler once (#1197)
  • c9744a3 middleware: test ClientIPFromHeader does not fall back to other headers (#1208)
  • fff8bb2 middleware: add Deprecation (RFC 9745), make Sunset RFC 8594 only (#1195)
  • 7f9b744 middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* (#1214)
  • 167e1e3 README: point middleware doc links to chi/v5 (#1196)
  • 3d1777a middleware: honor Discard when flushing (#1185)
  • b1c9ab4 middleware: record response status when flushing (#1174)
  • Additional commits viewable in compare view

Updates github.com/gowebpki/jcs from 1.0.1 to 1.0.2

Release notes

Sourced from github.com/gowebpki/jcs's releases.

Version 1.0.2

A fully implemented version of RFC 8785 for Golang with fixes for various bugs.

Commits

Updates github.com/onsi/ginkgo/v2 from 2.32.1 to 2.33.1

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.33.1

Fixes

  • Add several missing fields to spec report JSON output.

v2.33.0

Features

  • The JUnit reporter now records each spec's ReportEntrys as <properties> on its <testcase> element, with the entry's name and its JSON-encoded value. Thanks @​pohly! [23db51a]

Maintenance

  • Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. See RELEASING.md. [8616ecb]

v2.32.2

2.32.2

Fixes

  • fix bug where ginkgo -race -p was taking extra long to exit [c6792b0]
Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.33.1

Fixes

  • Add several missing fields to spec report JSON output.

2.33.0

Features

  • The JUnit reporter now records each spec's ReportEntrys as <properties> on its <testcase> element, with the entry's name and its JSON-encoded value. Thanks @​pohly! [23db51a]

Maintenance

  • Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. See RELEASING.md. [8616ecb]

2.32.2

Fixes

  • fix bug where ginkgo -race -p was taking extra long to exit [c6792b0]
Commits
  • 7ff96d7 v2.33.1
  • 699632a Precompile the fixture in the suite-timeout integration test (#1689)
  • 9e02cad ci: default the release bump so a mobile dispatch can't send it empty (#1688)
  • ef6a46c Update CHANGELOG.md
  • 6c652a2 Add missing fields to SpecReport JSON marshalling, and add unit test
  • 510c8d5 Update TestMu AI sponsor logo and link
  • 5c1e7ef Refer sanitizer help to go help build
  • 9f94149 v2.33.0
  • db78e1b changelog: entries for the JUnit ReportEntry support and the release flow
  • 8616ecb ci: release from a single workflow_dispatch button
  • Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.42.1 to 1.44.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.44.0

Fixes

  • BeNumerically compares signed and unsigned integers by value: -1 no longer equals uint64(math.MaxUint64) and uint(5) is now greater than -3 (#925) [26e3c6b]
  • BeNumerically("~") no longer overflows when computing the distance between extreme integers (#928) [1955764]
  • BeNumerically("==", x, threshold) now honors the threshold for floats, as it already did for integers (#927) [10e2aca]
  • HaveKeyWithValue succeeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]
  • HaveKey and HaveKeyWithValue treat key and value matcher errors like ContainElement does: a match wins, and an error is only reported when nothing matches (#926) [dc91598]
  • MatchJSON no longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]
  • MatchJSON compares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7, 630fe12]
  • HaveExactElements reports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]
  • MatchYAML compares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing ---) are ignored (#933) [2773796]
  • MatchXML ignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89, 2565350]

v1.43.1

Maintenance

  • Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
  • Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]

v1.43.0

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.44.0

Fixes

  • BeNumerically compares signed and unsigned integers by value: -1 no longer equals uint64(math.MaxUint64) and uint(5) is now greater than -3 (#925) [26e3c6b]
  • BeNumerically("~") no longer overflows when computing the distance between extreme integers (#928) [1955764]
  • BeNumerically("==", x, threshold) now honors the threshold for floats, as it already did for integers (#927) [10e2aca]
  • HaveKeyWithValue succeeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]
  • HaveKey and HaveKeyWithValue treat key and value matcher errors like ContainElement does: a match wins, and an error is only reported when nothing matches (#926) [dc91598]
  • MatchJSON no longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]
  • MatchJSON compares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7, 630fe12]
  • HaveExactElements reports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]
  • MatchYAML compares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing ---) are ignored (#933) [2773796]
  • MatchXML ignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89, 2565350]

1.43.1

Maintenance

  • Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
  • Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Commits
  • c933817 v1.44.0
  • 37fa900 v1.44.0 (full)
  • 509f2b0 changelog: entries for #925-#934
  • 2565350 fix: MatchXML compares namespace declarations by URI, ignoring the prefix
  • 630fe12 fix: MatchJSON only compares integers beyond 2^53 exactly
  • c0dbd89 fix: MatchXML ignores namespace prefixes and declarations
  • 2773796 fix: MatchYAML compares every document in a multi-document stream
  • af1b777 fix: HaveExactElements reports missing/extra elements starting at index 0
  • 8ef1aa7 fix: MatchJSON compares numbers exactly
  • 9d619a5 fix: MatchJSON reports numbers that do not fit in a float64
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Updates github.com/prometheus/client_model from 0.6.2 to 0.6.3

Release notes

Sourced from github.com/prometheus/client_model's releases.

v0.6.3

What's Changed

New Contributors

Full Changelog: prometheus/client_model@v0.6.2...v0.6.3

What's Changed

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 1…
f21861a 
…4 updates

Bumps the minor-and-patch group with 14 updates in the /operator directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | `1.21.1` | `1.21.3` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.3.0` | `5.5.0` |
| [github.com/gowebpki/jcs](https://github.com/gowebpki/jcs) | `1.0.1` | `1.0.2` |
| [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.32.1` | `2.33.1` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.42.1` | `1.44.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [github.com/prometheus/client_model](https://github.com/prometheus/client_model) | `0.6.2` | `0.6.3` |
| [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) | `1.3.0` | `1.4.0` |
| [github.com/spiffe/go-spiffe/v2](https://github.com/spiffe/go-spiffe) | `2.8.1` | `2.8.2` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.23.0` | `0.24.0` |
| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.36.3` | `0.37.2` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.3` | `0.37.2` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.3` | `0.37.2` |
| [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) | `0.24.1` | `0.25.2` |



Updates `github.com/cert-manager/cert-manager` from 1.21.1 to 1.21.3
- [Release notes](https://github.com/cert-manager/cert-manager/releases)
- [Changelog](https://github.com/cert-manager/cert-manager/blob/master/RELEASE.md)
- [Commits](cert-manager/cert-manager@v1.21.1...v1.21.3)

Updates `github.com/go-chi/chi/v5` from 5.3.0 to 5.5.0
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.3.0...v5.5.0)

Updates `github.com/gowebpki/jcs` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/gowebpki/jcs/releases)
- [Commits](gowebpki/jcs@v1.0.1...v1.0.2)

Updates `github.com/onsi/ginkgo/v2` from 2.32.1 to 2.33.1
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.32.1...v2.33.1)

Updates `github.com/onsi/gomega` from 1.42.1 to 1.44.0
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.42.1...v1.44.0)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `github.com/prometheus/client_model` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/prometheus/client_model/releases)
- [Commits](prometheus/client_model@v0.6.2...v0.6.3)

Updates `github.com/sigstore/sigstore-go` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](sigstore/sigstore-go@v1.3.0...v1.4.0)

Updates `github.com/spiffe/go-spiffe/v2` from 2.8.1 to 2.8.2
- [Release notes](https://github.com/spiffe/go-spiffe/releases)
- [Changelog](https://github.com/spiffe/go-spiffe/blob/main/CHANGELOG.md)
- [Commits](spiffe/go-spiffe@v2.8.1...v2.8.2)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](golang/sync@v0.23.0...v0.24.0)

Updates `k8s.io/apiextensions-apiserver` from 0.36.3 to 0.37.2
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases)
- [Commits](kubernetes/apiextensions-apiserver@v0.36.3...v0.37.2)

Updates `k8s.io/apimachinery` from 0.36.3 to 0.37.2
- [Commits](kubernetes/apimachinery@v0.36.3...v0.37.2)

Updates `k8s.io/client-go` from 0.36.3 to 0.37.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.3...v0.37.2)

Updates `sigs.k8s.io/controller-runtime` from 0.24.1 to 0.25.2
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.24.1...v0.25.2)

---
updated-dependencies:
- dependency-name: github.com/cert-manager/cert-manager
  dependency-version: 1.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/gowebpki/jcs
  dependency-version: 1.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.33.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/prometheus/client_model
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/spiffe/go-spiffe/v2
  dependency-version: 2.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: k8s.io/apiextensions-apiserver
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: k8s.io/client-go
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.25.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 3, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner November 3, 2026 00:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants