Skip to content

build(deps): bump the kubernetes group across 1 directory with 7 updates - #545

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/kubernetes-ccf3af818a
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/kubernetes-ccf3af818a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the kubernetes group with 7 updates in the / directory:

Package From To
k8s.io/apiextensions-apiserver 0.36.4 0.37.0
k8s.io/apimachinery 0.36.4 0.37.0
k8s.io/apiserver 0.36.4 0.37.0
k8s.io/client-go 0.36.4 0.37.0
k8s.io/utils 0.0.0-20260210185600-b8788abfbbc2 0.0.0-20260626114624-be93311217bd
sigs.k8s.io/agent-sandbox 1.0.0 1.0.2
sigs.k8s.io/controller-runtime 0.24.1 0.25.0

Updates k8s.io/apiextensions-apiserver from 0.36.4 to 0.37.0

Commits
  • 78b5577 Update dependencies to v0.37.0 tag
  • 29d19cf Fix unit test compile failure under the fieldsv1string build tag
  • 1aa2717 Merge pull request #140205 from pohly/cel-deps
  • b51744f dependencies: cel-go v0.29.2
  • f416935 Merge pull request #140782 from dims/update-kube-openapi
  • 19c0db2 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
  • 8ed17b6 Merge pull request #140774 from dims/prom-client-v1.24.0
  • 48a6e2f Update prometheus/client_golang to 1.24.0
  • e7c1b62 Merge pull request #139821 from pohly/client-go-informers-type-safety
  • e86edad Merge pull request #140740 from dims/update-grpc-1.82.1
  • Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.36.4 to 0.37.0

Commits
  • 7164e39 Update dependencies to v0.37.0 tag
  • e55f9ba feat(api): Update node restriction admission to use new API
  • cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis
  • 97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api
  • f21afab Add validation for camelcase in reason field
  • d7ad413 Merge pull request #140782 from dims/update-kube-openapi
  • e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist
  • 464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
  • 0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key
  • 95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...
  • Additional commits viewable in compare view

Updates k8s.io/apiserver from 0.36.4 to 0.37.0

Commits
  • 4d85a66 Update dependencies to v0.37.0 tag
  • a657dcf Keep the existing WantsAuthorizer interface as well for existing admission pl...
  • 24a394e Merge pull request #140860 from richabanker/watch-event-dispatch-latency-stor...
  • 04a5ff2 Merge pull request #140113 from pmengelbert/pmengelbert/authentication_to_adm...
  • b8516c3 Merge pull request #140851 from richabanker/watch-event-dispatch-latency-hand...
  • b60513a Merge pull request #140785 from ibihim/promote-unsafe-deletion-beta
  • 699454d etcd3: include first cause in corrupt object list error
  • bfd891b add storage_to_cache stage to watch dispatch metric
  • 033d4fd add handoff stage to watch dispatch metric
  • 8c6ff7d Merge pull request #140205 from pohly/cel-deps
  • Additional commits viewable in compare view

Updates k8s.io/client-go from 0.36.4 to 0.37.0

Commits
  • 2807644 Update dependencies to v0.37.0 tag
  • 50c6f9b metrics: Register: Fix incorrect assignment
  • 49f0a7b Merge pull request #140931 from pohly/client-go-changelog-adding-apigroups
  • 74d4b1e Merge pull request #140966 from alancaldelas/client-go-fakecustomstore-store
  • 2bf14f2 Merge pull request #140990 from xigang/revert-140448
  • 7b892fe Revert "Merge pull request #140448 from xigang/event_broadcaster_goroutine_leak"
  • df92378 Merge pull request #140334 from nojnhuh/dra-workloadresourceclaims-beta
  • 45a0ff1 client-go: restore FakeCustomStore conformance to cache.Store
  • 9d3b531 Merge pull request #139795 from omeryahud/worktree-kep-5963-device-compat-groups
  • 694f4eb apidiff: ignore adding entirely new API groups
  • Additional commits viewable in compare view

Updates k8s.io/utils from 0.0.0-20260210185600-b8788abfbbc2 to 0.0.0-20260626114624-be93311217bd

Commits

Updates sigs.k8s.io/agent-sandbox from 1.0.0 to 1.0.2

Release notes

Sourced from sigs.k8s.io/agent-sandbox's releases.

v1.0.2

🚀 Announcing Agent Sandbox v1.0.2!

We're excited to announce the release of Agent Sandbox v1.0.2! This release brings significant improvements across the sandbox router, SDKs, and reinforcement learning (RL) integrations. Key enhancements include Ed25519-based scoped-token v2 verification for fine-grained authorization, direct in-cluster connectivity options for the Go SDK, improved connection resiliency for the Python SDK, warm pool adoption and OpenHands integration in the RL framework, and controller observability metrics via controller-runtime v0.25.0.

⚠️ Breaking Changes / Action Required

  • Sandbox Router Authorizer Interface Update (authz.Authorizer) (#1497): The public Authorizer interface signature in Go sandbox-router has changed from taking separate (namespace, name) string arguments to accepting a single authz.AuthorizationTarget struct. Custom Authorizer implementations must update their Authorize method to inspect the fields of authz.AuthorizationTarget.
  • Sandbox Router Namespace Change (#1537): The Go sandbox-router manifests in sandbox-router/deploy/ have moved from the default namespace to agent-sandbox-system to enforce privilege separation and align with SDK defaults and NetworkPolicy rules. If you deploy raw manifests, ensure your manifests and scripts point to agent-sandbox-system.

Key Highlights

Sandbox Router & Security

  • Scoped-Token v2 Target Binding (#1497): Added Ed25519 scoped-token v2 verification binding tokens to Sandbox UID, port, HTTP method, and exact upstream path. Enables multi-key rotation and exclusive cutoff timestamps (--authz-scoped-token-v1-accept-until) for seamless migration from legacy HMAC v1 tokens.
  • Namespace & NetworkPolicy Alignment (#1537, #1539): Deployed the router to agent-sandbox-system and added the app: sandbox-router label to router deployment manifests, ensuring compatibility with the controller's secure-by-default SandboxTemplate NetworkPolicy.
  • OLM Operator Router Integration (#1425, #1477): Added the sandbox-router deployment, proxy service, and health checks directly to the Operator Lifecycle Manager (OLM) bundle.

Go & Python SDKs

  • Direct In-Cluster Connectivity in Go SDK (#1576): Added Options.Connectivity (ConnectivityInClusterService and ConnectivityInClusterPodIP), enabling workloads inside the cluster to connect directly to sandbox pods via headless service DNS or Pod IP without proxying through the API server or router.
  • Python SDK Connection Resilience on 4xx (#1574): Fixed an issue where HTTP 4xx responses (such as file not found) caused the connector to tear down the port-forward tunnel and clear the cached Pod IP. Tunnel teardown and routing invalidations are now reserved for transport failures and 5xx errors.
  • Async Client Concurrency & Flake Hardening (#1385, #1553): Added comprehensive E2E tests for AsyncSandboxClient validating concurrent execution and non-blocking event loops, with interval-overlap assertions resilient to sub-second warm-pool creation speeds.

Reinforcement Learning (RL) & Fleet Integrations

  • Warm Pool Adoption (#1556): Added FleetConfig.adopt_existing=True and FleetConfig.pool_name_format to the RL SDK, allowing training harnesses to discover and adopt pre-provisioned warm pools by container image rather than creating redundant pools.
  • OpenHands Fleet Adapter & Fan-Out (#1503): Introduced OpenHands integration shims (make_fleet_workspace, make_handle_workspace), advisory attach-time version skew detection, and scalable multi-agent example workflows (examples/run_openhands_fleet.py).
  • RL Quickstart Standardization (#1549): Updated setup steps to configure and provision workloads consistently in the agent-sandbox-rl namespace.

Controller Observability, Performance & MCP Server

  • controller-runtime v0.25.0 & REST Client Metrics (#1547): Upgraded controller-runtime to v0.25.0 and enabled client-go REST client metrics (rest_client_requests_total, rest_client_request_duration_seconds, rate-limiting, and retry counters) by default.
  • MCP Server Probes & Skills (#1339, #1534): Added /healthz (liveness) and /readyz (readiness) probe endpoints to the Model Context Protocol (MCP) server container and documented client skills for MCP tools.
  • Golden-Snapshot Warm Pools on GKE (#1522): Added an end-to-end example demonstrating golden-image warm pools restored directly from GKE Pod Snapshots.
  • High-Throughput Tuning & Diagnostics (#1593, #1552, #1555): Documented flags for connection sharding, write optimization, and refill rate limiting; tuned stress test networking defaults (nodeCIDRMaskSize=23); and added serial port log capture during benchmark cluster validation failures.

Installation

Standard Install (Core + Extensions)

Recommended for most users and GitOps engines (Argo CD, Config Sync, kustomize):

kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.2/sandbox-with-extensions.yaml

Selective Install

Install components separately:

# Core only:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.2/sandbox.yaml
</tr></table>

... (truncated)

Commits
  • 9a85153 feat(mcp): add /healthz and /readyz probe endpoints (#1339)
  • d9a6751 feat(go-sdk): add direct connectivity options for in-cluster pods (#1576)
  • 8618d2c fix(python-sdk): keep the connection open on 4xx responses (#1574)
  • e67e984 ci(helm): require a chart version bump for generated content (#1463)
  • 3d52457 docs: document high-throughput tuning, connection sharding, and refill shapin...
  • c9cd130 fix(router): add label to router deployment to match default NetworkPolicy (#...
  • e87bc38 rl-sdk: allow adopting warm pools provisioned by the fleet layer (#1556)
  • c0011ee feat(rl): OpenHands fleet adapter + fan-out example (stacked on #1488) (#1503)
  • b086d07 feat(router): add scoped-token v2 target binding (#1497)
  • 8423659 ci: use repo-wide golangci-lint in olm and fix protobuf doc comments (#1589)
  • Additional commits viewable in compare view

Updates sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.25.0

Highlights

This version of controller-runtime introduces a new experimental ReadYourWritesConsistency feature, which ensures that all writes are reflected in subsequent reads from the default cache-backed client. Stale client reads are arguably the biggest source of friction and sometimes bugs for controller authors, providing this functionality at the library level eliminates that class of problems entirely.

Try it out by setting Client.EnableReadYourWritesConsistency: new(true) in your manager and leave any feedback you may have on the tracking issue.

⚠️ Breaking Changes

✨ New Features

  • Client: Add a read-your-own-writes client (#3472)
  • Fakeclient: Add WithGlobalResourceVersionCounter (#3581)
  • Fakeclient: Add scale subresource support for Apply (#3569)
  • Metrics: Allow opt-in for client-go REST client metrics (#3510)
  • Metrics: Allow overriding client-go REST client metrics latency histogram buckets (#3573)
  • Source: Add TypedInformer source (#3520)
  • Webhooks: Allow to disable the webhook server by setting the port to -1 (#3481)

🐛 Bug Fixes

  • Cache: Fix goroutine leaks in cache Start() methods (#3565)
  • Client: Fix regression in Apply typed error handling (#3515)
  • Controller: Unlock when Controller.Start() returns with error (#3545)
  • Envtest: Fix envtest process stop on Windows (#3519)
  • Fakeclient: Allow updating managedFields through Update (#3585)
  • Fakeclient: Fix AddIndex panic when wrapped with an interceptor (#3583)
  • Fakeclient: Fix PartialObjectMeta handling (#3571)
  • Fakeclient: Support scale subresource get/update for unstructured objects (#3546)
  • Fakeclient: Update object on subresource apply (#3570)
  • PriorityQueue: Fix PriorityQueue deadlock on shutdown (#3540)
  • Testing/Process: Fix process Stop timeout error handling (#3523)

🌱 Others

  • LeaderElection: Pass Managers Logger to Leader Elector via Context (#3576)

🌱 CI & linters

  • Add copyright header validation & fix findings (#3544)
  • Bump to golangci-lint v2.12.1 (#3514)
  • Bump to golangci-lint v2.12.2 (#3532)
  • Bump to golangci-lint v2.13.1 (#3580)

... (truncated)

Commits
  • e8f9455 🐛 fakeclient: Allow updating managedFields through Update (#3585)
  • 0cc1315 Merge pull request #3565 from dongjiang1989/fix-leak
  • fa96780 🐛 Fix goroutine leaks in cache Start() methods
  • 1f5514b ✨ Add a read-your-own-write client (#3472)
  • df386c7 🌱 Bump to golangci-lint v2.13.1 (#3580)
  • dc7618f Merge pull request #3583 from pujitha24/auto/issue-3582
  • 37fe235 🐛 fake: fix AddIndex panic when client is wrapped with an interceptor
  • 01c7782 ✨ Allow overriding REST client latency histogram buckets (#3573)
  • 857be80 Merge pull request #3576 from demirdilek/fix-leaderelection-contextual-logging
  • b1387be Merge pull request #3581 from alvaroaleman/fake-consistent
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 10, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 10, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 633da56fd4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "Codex (@codex) address that feedback".

Comment thread go.mod Outdated
modernc.org/sqlite v1.57.0
sigs.k8s.io/agent-sandbox v1.0.0
sigs.k8s.io/controller-runtime v0.24.1
sigs.k8s.io/agent-sandbox v1.0.1

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Align the agent-sandbox deployment pins with v1.0.1

After this module is upgraded, the demo installer still deploys agent-sandbox v1.0.0 (hack/demos/cluster/install-agent-sandbox.sh:29-30) even though it explicitly says the version must match go.mod, while scripts/live-agent-sandbox-e2e.sh:18,79-80 defaults to v1.0.0 and rejects AGENT_SANDBOX_VERSION=v1.0.1. Consequently local experiments silently run the new SDK against old controllers, and the live E2E cannot validate the newly selected provider release; update both deployment pins and the corresponding static assertion in scripts/tests/static-mode-e2e-namespace-test.sh:272 with this dependency bump.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/kubernetes-ccf3af818a branch 3 times, most recently from 9374f7b to 4220651 Compare September 17, 2026 10:53
Bumps the kubernetes group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.36.4` | `0.37.0` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.4` | `0.37.0` |
| [k8s.io/apiserver](https://github.com/kubernetes/apiserver) | `0.36.4` | `0.37.0` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.4` | `0.37.0` |
| [k8s.io/utils](https://github.com/kubernetes/utils) | `0.0.0-20260210185600-b8788abfbbc2` | `0.0.0-20260626114624-be93311217bd` |
| [sigs.k8s.io/agent-sandbox](https://github.com/kubernetes-sigs/agent-sandbox) | `1.0.0` | `1.0.2` |
| [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) | `0.24.1` | `0.25.0` |



Updates `k8s.io/apiextensions-apiserver` from 0.36.4 to 0.37.0
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases)
- [Commits](kubernetes/apiextensions-apiserver@v0.36.4...v0.37.0)

Updates `k8s.io/apimachinery` from 0.36.4 to 0.37.0
- [Commits](kubernetes/apimachinery@v0.36.4...v0.37.0)

Updates `k8s.io/apiserver` from 0.36.4 to 0.37.0
- [Commits](kubernetes/apiserver@v0.36.4...v0.37.0)

Updates `k8s.io/client-go` from 0.36.4 to 0.37.0
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.4...v0.37.0)

Updates `k8s.io/utils` from 0.0.0-20260210185600-b8788abfbbc2 to 0.0.0-20260626114624-be93311217bd
- [Commits](https://github.com/kubernetes/utils/commits)

Updates `sigs.k8s.io/agent-sandbox` from 1.0.0 to 1.0.2
- [Release notes](https://github.com/kubernetes-sigs/agent-sandbox/releases)
- [Changelog](https://github.com/kubernetes-sigs/agent-sandbox/blob/main/docs/release.md)
- [Commits](kubernetes-sigs/agent-sandbox@v1.0.0...v1.0.2)

Updates `sigs.k8s.io/controller-runtime` from 0.24.1 to 0.25.0
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.24.1...v0.25.0)

---
updated-dependencies:
- dependency-name: k8s.io/apiextensions-apiserver
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: kubernetes
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: kubernetes
- dependency-name: k8s.io/apiserver
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: kubernetes
- dependency-name: k8s.io/client-go
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: kubernetes
- dependency-name: k8s.io/utils
  dependency-version: 0.0.0-20260626114624-be93311217bd
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: kubernetes
- dependency-name: sigs.k8s.io/agent-sandbox
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: kubernetes
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: kubernetes
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/kubernetes-ccf3af818a branch from 4220651 to 9c14a60 Compare September 18, 2026 04:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants