Rebased onto current master and re-vendored as requested.
The RC was validated in this PR earlier with no issues found.
Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>
Pulls in emicklei/go-restful#599 (released in v3.14.0), which caches compiled *regexp.Regexp instances in newPathExpression and embeds ParameterData by value inside Parameter, reducing kube-apiserver retained heap by -3.54 MB (-15,000 live heap objects).
Picks up kube-openapi #652 (NYTimes/gziphandler forked in, module dropped) and #644 (go-restful out of pkg/common). gziphandler leaves vendor and joins the blocklist; go-restful leaves the go.mod of twelve published modules.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
jsonpointer v1.0.2 fixes two uncaught panics in the name provider and
in Pointer.Set (GHSA-cqr7-r6x2-9cqf, GHSA-m8w9-vj7g-gxgg).
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
This is now a proper Go module; its dependency on google/btree is thus
apparent in unwanted-dependencies.json.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Matcher fixes only: BeNumerically compares signed and unsigned
integers by value and honours the float threshold, HaveKeyWithValue
no longer depends on map iteration order, MatchJSON compares integers
beyond 2^53 exactly, MatchYAML compares every document in a stream.
Test-only dependency.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
caddy v1.1.2 to v1.1.4 guard the Corefile parser against snippet
import cycles, unbounded expansion, an EOF loop in NextBlock and
nested-block errors. kubeadm parses the CoreDNS ConfigMap with it
through corefile-migration, which still floors caddy at v1.1.1.
gettext-go v1.0.3 fixes .po parsing of \r and a plural formula in
kubectl's i18n loader.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
All three were held back by the grpc pin. otlptracegrpc v1.46.0 needs
grpc-gateway v2.30.0, which stays pinned. Five otel modules leave the
go-spew and yaml.v3 unwanted-reference lists.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
v1.82.2 lacks the CVE-2026-84304 fix (grpc/grpc-go#9331, in v1.83.1+).
The four modules v1.83+ adds via cloud.google.com/go/auth are graph-only
(only credentials/google imports them, not vendored); record them in
status.unwantedReferences, option 1 of #142005.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
v1.2.10 drops the deprecated github.com/golang/protobuf requirement
(containerd/ttrpc#248) and github.com/prometheus/procfs (#249). ttrpc
leaves status.unwantedReferences for github.com/golang/protobuf, whose
remaining referencers are grpc, the etcd modules, protobuf-go and
go-grpc-middleware.
v2.9.3 fixes a decoder cursor desync when a time tag wraps a map or an
array (fxamacker/cbor#802, #803). v2.9.4 fixes a panic when decoding
uncomparable map keys (#817). Both are on the apiserver CBOR decode
path behind the CBORServingAndStorage gate.
golang.org/x/net v0.59.0, crypto v0.57.0, sys v0.48.0, term v0.46.0,
text v0.42.0, sync v0.23.0, tools v0.50.0, mod v0.41.0, time v0.16.0,
oauth2 v0.37.0, exp 85c1c2202aba, and github.com/mdlayher/socket v0.7.0.
x/mod v0.40.0 fixed CVE-2026-56865 and CVE-2026-56864 in sumdb; the
package is not vendored but module scanners flag the requirement. The
floors move together: x/net v0.59.0 requires the crypto, sys, term and
text versions above, x/crypto v0.57.0 and mdlayher/socket v0.7.0
require x/net >= v0.58.0, and x/tools v0.50.0 requires x/mod v0.41.0.
This change updates four dependencies:
- github.com/containerd/containerd/api from v1.11.0 to v1.11.1
- github.com/cyphar/filepath-securejoin from v0.6.1 to v0.7.0
- github.com/opencontainers/cgroups from v0.0.6 to v0.0.7
- github.com/opencontainers/selinux from v1.13.1 to v1.15.1
The new filepath-securejoin release requires a newer version of
cyphar.com/go-pathrs, so that module also moves from v0.2.2 to v0.2.5.
The file hack/unwanted-dependencies.json did not need any changes.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
When the container runtime provides stats via CRI, cAdvisor only needs
to track the root container for node-level resource and filesystem
metrics. Set DisableContainerDiscovery on the cAdvisor manager to skip
plugin initialization, cgroup watchers, and subcontainer scanning in
that mode.
Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
The new cadvisor version requires newer golang.org/x modules. Module
version selection raised crypto, mod, net, sync, sys, term, text, and
tools. golang.org/x/net moves from a pseudo-version to the v0.57.0
release, which includes the http2 fixes the pseudo-version pointed at.
cadvisor/lib no longer depends on github.com/gogo/protobuf. This change
removes cadvisor/lib from the gogo/protobuf dependants list in
hack/unwanted-dependencies.json.
This update adds a a new command-line flag to tests, --sleep-on-failure,
which pauses execution at the first failed assertion. This gives time to
debug the state of the system before the After* hooks teardown any
state.
Signed-off-by: Casey Callendrello <c1@caseyc.net>
kubernetes-prow[bot]