Skip to content

Conversation

@Ruclo
Copy link
Contributor

@Ruclo Ruclo commented Jan 13, 2026

What this PR does / why we need it:
Due to go.podman.io/storage v1.61.0 requiring github.com/cyphar/filepath-securejoin v0.5.1,
I decided to fix the version in order to avoid further issues till support for higher version is adapted.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #465

Special notes for your reviewer:

Release note:

NONE

dependabot bot and others added 2 commits January 13, 2026 07:24
…y with 9 updates

Bumps the production-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.46.0` | `0.47.0` |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.5.1` | `0.6.1` |
| [github.com/docker/cli](https://github.com/docker/cli) | `29.1.3+incompatible` | `29.1.4+incompatible` |
| [github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring](https://github.com/prometheus-operator/prometheus-operator) | `0.87.1` | `0.88.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.31.0` | `0.32.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.48.0` | `0.49.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.40.0` | `0.41.0` |



Updates `golang.org/x/crypto` from 0.46.0 to 0.47.0
- [Commits](golang/crypto@v0.46.0...v0.47.0)

Updates `golang.org/x/text` from 0.32.0 to 0.33.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.32.0...v0.33.0)

Updates `github.com/cyphar/filepath-securejoin` from 0.5.1 to 0.6.1
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.5.1...v0.6.1)

Updates `github.com/docker/cli` from 29.1.3+incompatible to 29.1.4+incompatible
- [Commits](docker/cli@v29.1.3...v29.1.4)

Updates `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` from 0.87.1 to 0.88.0
- [Release notes](https://github.com/prometheus-operator/prometheus-operator/releases)
- [Changelog](https://github.com/prometheus-operator/prometheus-operator/blob/main/CHANGELOG.md)
- [Commits](prometheus-operator/prometheus-operator@v0.87.1...v0.88.0)

Updates `golang.org/x/mod` from 0.31.0 to 0.32.0
- [Commits](golang/mod@v0.31.0...v0.32.0)

Updates `golang.org/x/net` from 0.48.0 to 0.49.0
- [Commits](golang/net@v0.48.0...v0.49.0)

Updates `golang.org/x/term` from 0.38.0 to 0.39.0
- [Commits](golang/term@v0.38.0...v0.39.0)

Updates `golang.org/x/tools` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.40.0...v0.41.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.6.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: github.com/docker/cli
  dependency-version: 29.1.4+incompatible
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
  dependency-version: 0.88.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: golang.org/x/mod
  dependency-version: 0.32.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.49.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.39.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.41.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
Fixed the version of github.com/cyphar/filepath-securejoin to v0.5.1
because of go.podman.io/storage v1.61.0 requiring it.

Signed-off-by: Michal Vavrinec <[email protected]>
@kubevirt-bot kubevirt-bot added release-note-none Denotes a PR that doesn't merit a release note. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Jan 13, 2026
@kubevirt-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign dominikholler for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've found 1 issue, and left some high level feedback:

  • The new replace github.com/cyphar/filepath-securejoin => ... v0.5.1 conflicts with the updated indirect requirement to v0.6.1; consider aligning these so that the require section and the enforced version via replace are consistent.
  • Most Kubernetes modules were bumped to v0.34.3 but k8s.io/client-go remains at v0.34.2; it’s usually safer to keep these core k8s dependencies on the same patch level unless there’s a specific reason not to.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- The new `replace github.com/cyphar/filepath-securejoin => ... v0.5.1` conflicts with the updated indirect requirement to `v0.6.1`; consider aligning these so that the `require` section and the enforced version via `replace` are consistent.
- Most Kubernetes modules were bumped to `v0.34.3` but `k8s.io/client-go` remains at `v0.34.2`; it’s usually safer to keep these core k8s dependencies on the same patch level unless there’s a specific reason not to.

## Individual Comments

### Comment 1
<location> `go.mod:30` </location>
<code_context>
-	k8s.io/apimachinery v0.34.2
+	golang.org/x/crypto v0.47.0
+	golang.org/x/text v0.33.0
+	k8s.io/api v0.34.3
+	k8s.io/apimachinery v0.34.3
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
</code_context>

<issue_to_address>
**issue (bug_risk):** Kubernetes module versions are partially bumped, leaving k8s.io/client-go at 0.34.2, which may cause skew.

Since k8s.io/api and k8s.io/apiextensions-apiserver are now at v0.34.3, it’s safer to align k8s.io/client-go to v0.34.3 as well to avoid version skew and potential subtle incompatibilities. If you need to keep client-go at v0.34.2, please confirm there’s a specific reason or known incompatibility.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

k8s.io/apimachinery v0.34.2
golang.org/x/crypto v0.47.0
golang.org/x/text v0.33.0
k8s.io/api v0.34.3
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): Kubernetes module versions are partially bumped, leaving k8s.io/client-go at 0.34.2, which may cause skew.

Since k8s.io/api and k8s.io/apiextensions-apiserver are now at v0.34.3, it’s safer to align k8s.io/client-go to v0.34.3 as well to avoid version skew and potential subtle incompatibilities. If you need to keep client-go at v0.34.2, please confirm there’s a specific reason or known incompatibility.

@kubevirt-bot
Copy link
Contributor

@Ruclo: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-containerdisks-test e611976 link true /test pull-containerdisks-test
Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@kubevirt-bot kubevirt-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 19, 2026
@kubevirt-bot
Copy link
Contributor

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dco-signoff: yes Indicates the PR's author has DCO signed all their commits. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. release-note-none Denotes a PR that doesn't merit a release note. size/XXL

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants