[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
k8s.io/kube-openapi	indirect	digest	2c72e55 → ca3452a

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/google/gnostic-models	v0.6.9 -> v0.7.0

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:45 AM UTC · Completed 5:48 AM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [api-contract] go.mod:3 — The go directive changed from go 1.26.0 (with toolchain go1.26.3) to go 1.27.0 (with no toolchain directive). This raises the minimum required Go version to 1.27.0. However, the Dockerfile (line 2) uses golang:1.26-alpine and the CI workflow .github/workflows/tests.yml (lines 21 and 61) uses go-version: '1.26' for both lint and test jobs. Neither is updated in this PR. With GOTOOLCHAIN=auto (the default since Go 1.21), Go 1.26 would attempt to auto-download Go 1.27 at build time, which is fragile in CI and container build environments (depends on network access, download server availability, and adds latency). If GOTOOLCHAIN=local is set or auto-download fails, builds will fail outright with a version mismatch error. The toolchain directive is also dropped entirely, removing the previously explicit toolchain pinning. This is a scope escalation beyond a simple digest update — the PR title says "update k8s.io/kube-openapi digest" but the Go minimum version jumps a minor release and the toolchain directive is dropped.
  Remediation: Either (a) update the Dockerfile to golang:1.27-alpine and the CI workflow to go-version: '1.27' in this PR, or (b) keep the go 1.26.0 / toolchain go1.26.3 pair and find a version of kube-openapi that does not require Go 1.27. If Go 1.27 is intentional, the Dockerfile and CI must be updated in the same PR to avoid broken builds on main.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [api-contract] go.mod:3 — The go directive changed from go 1.25.0 (with toolchain go1.26.3) to go 1.27.0 (with no toolchain directive). This raises the minimum required Go version to 1.27.0. However, the Dockerfile (line 2) uses golang:1.26-alpine and the CI workflow .github/workflows/tests.yml (lines 21 and 61) uses go-version: '1.26' for both lint and test jobs. Neither is updated in this PR. With GOTOOLCHAIN=auto (the default since Go 1.21), Go 1.26 would attempt to auto-download Go 1.27 at build time, which is fragile in CI and container build environments (depends on network access, download server availability, and adds latency). If GOTOOLCHAIN=local is set or auto-download fails, builds will fail outright with a version mismatch error. This is a scope escalation beyond a simple digest update — the PR title says "update k8s.io/kube-openapi digest" but the Go minimum version jumps two minor releases and the toolchain directive is dropped entirely.
  Remediation: Either (a) update the Dockerfile to golang:1.27-alpine and the CI workflow to go-version: '1.27' in this PR, or (b) keep the go 1.25.0 / toolchain go1.26.3 pair and find a version of kube-openapi that does not require Go 1.27. If Go 1.27 is intentional, the Dockerfile and CI must be updated in the same PR to avoid broken builds on main.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [api-contract] go.mod:3 — The go directive changed from go 1.25.0 (with toolchain go1.26.3) to go 1.27.0 (with no toolchain directive). This raises the minimum required Go version to 1.27.0. However, the Dockerfile (line 2) uses golang:1.26-alpine and the CI workflow .github/workflows/tests.yml (lines 21 and 61) uses go-version: '1.26' for both lint and test jobs. Neither is updated in this PR. With GOTOOLCHAIN=auto (the default since Go 1.21), Go 1.26 would attempt to auto-download Go 1.27 at build time, which is fragile in CI and container build environments (depends on network access, download server availability, and adds latency). If GOTOOLCHAIN=local is set or auto-download fails, builds will fail outright with a version mismatch error. This is a scope escalation beyond a simple digest update — the PR title says "update k8s.io/kube-openapi digest" but the Go minimum version jumps two minor releases and the toolchain directive is dropped entirely.
  Remediation: Either (a) update the Dockerfile to golang:1.27-alpine and the CI workflow to go-version: '1.27' in this PR, or (b) keep the go 1.25.0 / toolchain go1.26.3 pair and find a version of kube-openapi that does not require Go 1.27. If Go 1.27 is intentional, the Dockerfile and CI must be updated in the same PR to avoid broken builds on main.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

High

• [api-contract] go.mod:3 — The go directive changed from go 1.25.0 (with toolchain go1.26.3) to go 1.27.0 (with no toolchain directive). This raises the minimum required Go version to 1.27.0. However, the Dockerfile (line 2) uses golang:1.26-alpine and the CI workflow .github/workflows/tests.yml (lines 21 and 61) uses go-version: '1.26' for both lint and test jobs. Neither is updated in this PR. With GOTOOLCHAIN=auto (the default since Go 1.21), Go 1.26 would attempt to auto-download Go 1.27 at build time, which is fragile in CI and container build environments (depends on network access, download server availability, and adds latency). If GOTOOLCHAIN=local is set or auto-download fails, builds will fail outright with a version mismatch error. This is a scope escalation beyond a simple digest update — the PR title says "update k8s.io/kube-openapi digest" but the Go minimum version jumps two minor releases and the toolchain directive is dropped entirely.
  Remediation: Either (a) update the Dockerfile to golang:1.27-alpine and the CI workflow to go-version: '1.27' in this PR, or (b) keep the go 1.25.0 / toolchain go1.26.3 pair and find a version of kube-openapi that does not require Go 1.27. If Go 1.27 is intentional, the Dockerfile and CI must be updated in the same PR to avoid broken builds on main.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review

Findings

High

• [api-contract] go.mod:3 — The go directive was changed from go 1.25.0 (with toolchain go1.26.3) to go 1.27.0 (with no toolchain directive). This raises the minimum required Go version to 1.27.0. However, the Dockerfile (line 2) uses golang:1.26-alpine and the CI workflow .github/workflows/tests.yml (lines 21, 61) uses go-version: '1.26' for both lint and test jobs. Neither is updated in this PR. With GOTOOLCHAIN=auto (the default since Go 1.21), Go 1.26 would attempt to auto-download Go 1.27 at build time, which is fragile in CI and container build environments (depends on network access, download server availability, and adds latency). If GOTOOLCHAIN=local is set or auto-download fails, builds will fail outright with a version mismatch error. This is a scope escalation beyond a simple digest update — the PR title says "update k8s.io/kube-openapi digest" but the Go minimum version jumps two minor releases.
  Remediation: Either (a) update the Dockerfile to golang:1.27-alpine and the CI workflow to go-version: '1.27' in this PR, or (b) keep the go 1.25.0 / toolchain go1.26.3 pair and find a version of kube-openapi that does not require Go 1.27. If Go 1.27 is intentional, the Dockerfile and CI must be updated in the same PR to avoid broken builds on main.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (5)

Looks good to me

Previous run (6)

Review — ✅ Approve

PR: #157 — chore(deps): update k8s.io/kube-openapi digest to cdb1db5
Author: red-hat-konflux[bot] (MintMaker/Renovate)
Risk: Low — automated indirect dependency update, no application code changes

Summary

This is an automated dependency update that bumps the indirect dependency k8s.io/kube-openapi from digest 2c72e55 (Dec 2024) to cdb1db5 (Jul 2026). Only go.mod and go.sum are modified.

Changes Reviewed

Dependency	Change	Type
k8s.io/kube-openapi	2c72e554b1e7 → cdb1db5517a0	indirect, digest update
github.com/google/gnostic-models	v0.6.9 → v0.7.0	indirect, transitive bump
sigs.k8s.io/randfill	(new) v1.0.0	indirect, new transitive dep
sigs.k8s.io/structured-merge-diff/v6	(new) v6.4.1	indirect, new transitive dep

Dimension Assessment

• Correctness: go.mod and go.sum are internally consistent. The new transitive dependencies (randfill, structured-merge-diff/v6) are expected consequences of the kube-openapi update. The existing structured-merge-diff/v4 is retained for other consumers — having both v4 and v6 is normal Go module behavior for different major version paths.
• Security: All updated packages are well-known Kubernetes ecosystem libraries from trusted organizations (kubernetes, kubernetes-sigs, Google). No new external or unfamiliar dependencies introduced.
• Intent & coherence: The change matches its declared purpose. Branch name, PR title, and diff are all aligned. No scope creep.
• Style/conventions: Standard go mod formatting, no manual edits.
• Documentation: No documentation impact — module file changes only.
• Cross-repo contracts: No API surface changes — all affected dependencies are indirect.

Verdict

No findings at low severity or above. This is a clean, well-scoped automated dependency update. Safe to merge.

Previous run (7)

Review — approve

PR: #157 — chore(deps): update k8s.io/kube-openapi digest to cdb1db5
Author: red-hat-konflux[bot] (MintMaker/Renovate)

Summary

Routine automated dependency update. Changes are limited to go.mod and go.sum — no source code modifications.

Dependencies updated (all indirect):

Package	Old	New	Notes
k8s.io/kube-openapi	2c72e554b1e7 (Dec 2024)	cdb1db5517a0 (Jul 2026)	Primary update target
github.com/google/gnostic-models	v0.6.9	v0.7.0	Transitive bump
sigs.k8s.io/randfill	(new)	v1.0.0	New transitive dep
sigs.k8s.io/structured-merge-diff/v6	(new)	v6.4.1	New major version coexists with v4
github.com/google/pprof	20240727...	20240525...	Transitive hash change

Analysis

• Correctness: All updated packages are indirect dependencies — this project does not import them directly. They are pulled in through the k8s.io dependency chain. The go.mod and go.sum entries are consistent and properly paired.
• Compatibility: The structured-merge-diff/v6 module coexists with the existing v4 — this is standard Go module behavior (distinct import paths). The rest of the k8s.io stack remains at v0.31.x, and kube-openapi is consumed indirectly through that chain.
• Security: No new direct dependencies, no credential changes, no manifest modifications. All packages are from well-known Kubernetes SIG repositories.
• Scope: The change is tightly scoped to the dependency update described in the title. No unrelated changes.

Verdict

Approve — clean automated dependency digest update with no source code changes and no risk surface beyond standard transitive dependency resolution. CI should confirm build and test compatibility.

Previous run (8)

Looks good to me

Previous run (9)

Looks good to me

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:26 PM UTC · Completed 9:30 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:46 AM UTC · Completed 1:49 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:19 AM UTC · Completed 9:22 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:04 PM UTC · Completed 2:11 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:18 PM UTC · Completed 9:30 PM UTC

Commit: ee0f172 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.09

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Bot-authored indirect Go dependency update (k8s.io/kube-openapi) touching only go.mod and go.sum; Tier 1 and Tier 2 signals are unchanged from the prior review — same 2 dependency files, same bot author, same moderate churn and fix-commit frequency on these files — sustaining the prior moderate score of 2.

Previous run

Risk Assessment: moderate (2/5)

Details

Bot-authored indirect Go dependency update (k8s.io/kube-openapi) touching only go.mod and go.sum; Tier 1 signals are unchanged from prior review with 2 dependency files elevating the score, while Tier 2 confirms moderate churn and fix-commit frequency on these files, sustaining the prior moderate score of 2.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Bot-authored indirect Go dependency update (k8s.io/kube-openapi) touching only go.mod and go.sum; Tier 1 signals are unchanged from prior review with 2 dependency files and zero test ratio elevating the score, while Tier 2 confirms moderate churn and moderate fix-commit frequency, together sustaining the prior moderate score of 2.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Bot-authored indirect Go dependency update (k8s.io/kube-openapi) touching only go.mod and go.sum; Tier 1 signals are unchanged from prior review with 2+ dependency files and zero test ratio elevating the score, while Tier 2 confirms moderate churn and fix-commit frequency, together sustaining the prior moderate score of 2.

Previous run (4)

Risk Assessment: moderate (2/5)

Details

Bot-authored indirect Go dependency update (k8s.io/kube-openapi) touching only go.mod and go.sum; the 2+ dependency files signal and recent fix-commit churn elevate the score from low to moderate despite bot authorship and no CI or protected path changes.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:53 AM UTC · Completed 1:02 AM UTC

Commit: fb83597 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.12

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:10 AM UTC · Completed 1:20 AM UTC

Commit: 6186dce · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.67

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:45 AM UTC · Completed 6:55 AM UTC

Commit: ab37c47 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.67

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:06 AM UTC · Completed 7:17 AM UTC

Commit: a2b9d25 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.38

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] api-contract

The go directive changed from go 1.26.0 (with toolchain go1.26.3) to go 1.27.0 (with no toolchain directive). This raises the minimum required Go version to 1.27.0. However, the Dockerfile (line 2) uses golang:1.26-alpine and the CI workflow .github/workflows/tests.yml (lines 21 and 61) uses go-version 1.26 for both lint and test jobs. Neither is updated in this PR. With GOTOOLCHAIN=auto (the default since Go 1.21), Go 1.26 would attempt to auto-download Go 1.27 at build time, which is fragile in CI and container build environments. If GOTOOLCHAIN=local is set or auto-download fails, builds will fail outright with a version mismatch error. The toolchain directive is also dropped entirely, removing the previously explicit toolchain pinning.

Suggested fix: Either (a) update the Dockerfile to golang:1.27-alpine and the CI workflow to go-version 1.27 in this PR, or (b) keep the go 1.26.0 / toolchain go1.26.3 pair and find a version of kube-openapi that does not require Go 1.27. If Go 1.27 is intentional, the Dockerfile and CI must be updated in the same PR to avoid broken builds on main.