Rebased onto current master and re-vendored as requested.
The RC was validated in this PR earlier with no issues found.
Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>
Pulls in emicklei/go-restful#599 (released in v3.14.0), which caches compiled *regexp.Regexp instances in newPathExpression and embeds ParameterData by value inside Parameter, reducing kube-apiserver retained heap by -3.54 MB (-15,000 live heap objects).
Picks up kube-openapi #652 (NYTimes/gziphandler forked in, module dropped) and #644 (go-restful out of pkg/common). gziphandler leaves vendor and joins the blocklist; go-restful leaves the go.mod of twelve published modules.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
jsonpointer v1.0.2 fixes two uncaught panics in the name provider and
in Pointer.Set (GHSA-cqr7-r6x2-9cqf, GHSA-m8w9-vj7g-gxgg).
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Picks up kubernetes/kube-openapi#641 (testify v1.12.1; go-spew,
go-difflib and gopkg.in/yaml.v3 leave its go.mod, so kube-openapi
drops out of both referencer lists in hack/unwanted-dependencies.json)
and #639, which reads +k8s:optional and +k8s:required as aliases of
+optional and +required.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
This is now a proper Go module; its dependency on google/btree is thus
apparent in unwanted-dependencies.json.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Matcher fixes only: BeNumerically compares signed and unsigned
integers by value and honours the float threshold, HaveKeyWithValue
no longer depends on map iteration order, MatchJSON compares integers
beyond 2^53 exactly, MatchYAML compares every document in a stream.
Test-only dependency.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
caddy v1.1.2 to v1.1.4 guard the Corefile parser against snippet
import cycles, unbounded expansion, an EOF loop in NextBlock and
nested-block errors. kubeadm parses the CoreDNS ConfigMap with it
through corefile-migration, which still floors caddy at v1.1.1.
gettext-go v1.0.3 fixes .po parsing of \r and a plural formula in
kubectl's i18n loader.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
All three were held back by the grpc pin. otlptracegrpc v1.46.0 needs
grpc-gateway v2.30.0, which stays pinned. Five otel modules leave the
go-spew and yaml.v3 unwanted-reference lists.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
v1.82.2 lacks the CVE-2026-84304 fix (grpc/grpc-go#9331, in v1.83.1+).
The four modules v1.83+ adds via cloud.google.com/go/auth are graph-only
(only credentials/google imports them, not vendored); record them in
status.unwantedReferences, option 1 of #142005.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
v1.2.10 drops the deprecated github.com/golang/protobuf requirement
(containerd/ttrpc#248) and github.com/prometheus/procfs (#249). ttrpc
leaves status.unwantedReferences for github.com/golang/protobuf, whose
remaining referencers are grpc, the etcd modules, protobuf-go and
go-grpc-middleware.
v2.9.3 fixes a decoder cursor desync when a time tag wraps a map or an
array (fxamacker/cbor#802, #803). v2.9.4 fixes a panic when decoding
uncomparable map keys (#817). Both are on the apiserver CBOR decode
path behind the CBORServingAndStorage gate.
golang.org/x/net v0.59.0, crypto v0.57.0, sys v0.48.0, term v0.46.0,
text v0.42.0, sync v0.23.0, tools v0.50.0, mod v0.41.0, time v0.16.0,
oauth2 v0.37.0, exp 85c1c2202aba, and github.com/mdlayher/socket v0.7.0.
x/mod v0.40.0 fixed CVE-2026-56865 and CVE-2026-56864 in sumdb; the
package is not vendored but module scanners flag the requirement. The
floors move together: x/net v0.59.0 requires the crypto, sys, term and
text versions above, x/crypto v0.57.0 and mdlayher/socket v0.7.0
require x/net >= v0.58.0, and x/tools v0.50.0 requires x/mod v0.41.0.
Update konnectivity network proxy to v0.37.0
Include CVE fixes.
Decoupled send/recv in data-plane to control-plane in agent.
Improve connection selection from server.
Unified HTTP-CONNECT and GRPC packet handling in server.
Improved HTTP-CONNECT handling for slow connection.
Reject malformed certificate blocks in CA bundles.
Added connection_duration_seconds histogram.
Added exported DialFailureReason on setup.
Added reuable tunnel.
Fix CFSSL build on mac.
Fix agent drain signal blocked by stream RECV.
Made CloseHTTP idempotent.
Fix removeEstablishedForBackendConn from retiring entire backend.
Fixed race condition on response through agent.
Made lease labels a real label selector.
Restored non-graceful shutdown behavior.
Update dependencies ANP dependencies.
Update ANP client dependencies to match K/K 1.34.
Yongrui Lin