deps: bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.1 - #2324
Closed
dependabot[bot] wants to merge 1 commit into
Closed
deps: bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.1#2324dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
area/dependencies
dependabot
Bot
requested review from
Alex Castilio (alexcastilio) and
Evan Baker (rbtr)
May 12, 2026 19:50
dependabot
Bot
added
area/dependencies
dependabot
Bot
force-pushed
the
dependabot/go_modules/sigs.k8s.io/controller-runtime-0.24.1
branch
from
May 13, 2026 01:22
182a04e to
8f321f0
Compare
Member
|
Dependabot (@dependabot) rebase |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/sigs.k8s.io/controller-runtime-0.24.1
branch
2 times, most recently
from
May 14, 2026 16:02
91e60f4 to
9d9d44c
Compare
Contributor
Author
|
Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request. |
1 similar comment
Contributor
Author
|
Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request. |
Contributor
Author
|
Dependabot failed to update your dependencies. Because of this, Dependabot cannot update this pull request. |
Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.23.3 to 0.24.1. - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](kubernetes-sigs/controller-runtime@v0.23.3...v0.24.1) --- updated-dependencies: - dependency-name: sigs.k8s.io/controller-runtime dependency-version: 0.24.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/sigs.k8s.io/controller-runtime-0.24.1
branch
from
June 2, 2026 21:46
9d9d44c to
b901b73
Compare
Contributor
Author
|
Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request. |
Member
|
Dependabot (@dependabot) rebase |
Contributor
Author
|
Dependabot can't resolve your Go dependency files. Because of this, Dependabot cannot update this pull request. |
7 tasks
pull Bot
pushed a commit
to TheTechOddBug/retina
that referenced
this pull request
Jul 13, 2026
# Description The `k8s` dependabot group only covers `patch` updates, so k8s release trains (`v0.35` → `v0.36` across `k8s.io/api`, `apimachinery`, `client-go`, `kubectl`, `metrics`, …) arrive as individual PRs. Those modules version in lockstep, so a lone bump is unresolvable — microsoft#2329 has been failing dependency resolution for weeks: ``` k8s.io/metrics | dependency_file_not_resolvable | "go: ...k8s.io/kubectl/pkg/scheme imports k8s.io/api/scheduling/v1alpha1: module k8s.io/api@latest found (v0.36.2), but does not contain package k8s.io/api/scheduling/v1alpha1" ``` The paired `sigs.k8s.io/controller-runtime` minor (microsoft#2324, `0.23` → `0.24`, which requires k8s `v0.36`) fails the same way. This extends the group to `minor` updates so the whole lockstep set ships as one PR. Majors stay excluded — k8s.io core modules are perpetually `v0.x`, so the release train is always a minor. ## Related Issue N/A — follow-up from reviewing failing dependabot updates. ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. - [ ] I have added tests, if applicable. (N/A — dependabot config.) ## Screenshots (if applicable) or Testing Completed YAML parses clean; dependabot validates the config on its next scheduled run — config-only change. ## Additional Notes After this merges, close microsoft#2329 and microsoft#2324; the next daily gomod run will regenerate them as a single grouped `k8s` PR containing the coherent `v0.36` set. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
7 tasks
Contributor
Author
|
Superseded by #2587. |
dependabot
Bot
deleted the
dependabot/go_modules/sigs.k8s.io/controller-runtime-0.24.1
branch
July 27, 2026 16:35
pull Bot
pushed a commit
to weiyilai/retina
that referenced
this pull request
Jul 27, 2026
# Description Dependabot splits three dependency families that must move together, so each PR is unmergeable on its own. **codeql-action** — `codeql.yaml` pins `init`, `autobuild` and `analyze` to one SHA, and CodeQL rejects mixed versions. `actions-patch` covers `patch` only, so minor bumps get one PR per sub-action and every `Analyze` job fails: ``` ##[error]Loaded a configuration file for version '4.36.3', but running version '4.37.2' ``` That is microsoft#2573, microsoft#2574 and microsoft#2575. **k8s** — `helm.sh/helm/v3` is in no group but pins `k8s.io/client-go` transitively (`v3.21.3` needs `v0.36.2`, `controller-runtime v0.23.3` needs `v0.35.0`). Bumping helm alone fails on `handlerRegistration does not implement cache.ResourceEventHandlerRegistration (missing method HasSyncedChecker)`, so microsoft#2544 and microsoft#2324 are two halves of one change. **cilium** — `cilium/cilium v1.19.3` pins `hive`, `statedb` and `stream` to exactly retina's versions; moving them alone breaks cilium's own source (microsoft#2543, microsoft#2520). ## Changes - **codeql-action**: group over `github/codeql-action*`, covering all four sub-actions in `codeql.yaml` and `trivy.yaml`. `actions-patch` gets a matching `exclude-patterns`: with no `patterns` of its own it scores 500 against the new group's 106, so it would otherwise claim these and then drop them for not being `patch`. - **k8s**: adds `helm.sh/helm/v3` and the exact path `sigs.k8s.io/cloud-provider-azure/pkg/azclient/configloader`, which pins client-go the same way. An exact path scores 1000, outranking `azure-sdk`. The exclusion narrows to `pkg/azclient`, which has no client-go dependency. - **cilium**: ignore `hive`, `statedb` and `stream`. MVS still raises them when `cilium/cilium` moves. - **otel**: widened to `minor`; `1.43.0` → `1.44.0` arrived as three PRs (microsoft#2408, microsoft#2409, microsoft#2410). ## Related Issue N/A. ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). See [this documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification) on signing commits. - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. - [ ] I have added tests, if applicable. ## Screenshots (if applicable) or Testing Completed Local run against the real updater image: `main` produces three ungrouped codeql PRs, this config produces one holding all four. Dropping `exclude-patterns` reproduces `main` exactly. Hosted Dependabot on a fork: | PR | Contents | |---|---| | codeql-action, 4 updates | all four sub-actions on one SHA, `v4.37.3` | | k8s, 7 updates | helm `3.21.1` → `3.21.3`, controller-runtime `0.23.3` → `0.24.1`, `k8s.io/*` → `0.36.2` | | cilium, 4 updates | `cilium/cilium` `v1.19.3` → `v1.19.6` with `ebpf v0.22.0` and `statedb v0.5.9`, as `v1.19.6` requires | Schema-validates against `dependabot-2.0.json` with no new errors versus `main`. ## Additional Notes `configloader` stays put until the k8s group lands: its bump raises `k8s.io/api` to `0.36.x` while `kubectl` stays at `0.35.3`, whose `pkg/scheme` imports `k8s.io/api/scheduling/v1alpha1`, removed in `0.36`. `go mod tidy` fails with it alone and passes with the full set, so no extra config is needed. Once this lands, microsoft#2573, microsoft#2574, microsoft#2575, microsoft#2544, microsoft#2324, microsoft#2543 and microsoft#2520 can be closed. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
Laksh (lakshk98)
pushed a commit
to lakshk98/retina
that referenced
this pull request
Aug 4, 2026
# Description The `k8s` dependabot group only covers `patch` updates, so k8s release trains (`v0.35` → `v0.36` across `k8s.io/api`, `apimachinery`, `client-go`, `kubectl`, `metrics`, …) arrive as individual PRs. Those modules version in lockstep, so a lone bump is unresolvable — microsoft#2329 has been failing dependency resolution for weeks: ``` k8s.io/metrics | dependency_file_not_resolvable | "go: ...k8s.io/kubectl/pkg/scheme imports k8s.io/api/scheduling/v1alpha1: module k8s.io/api@latest found (v0.36.2), but does not contain package k8s.io/api/scheduling/v1alpha1" ``` The paired `sigs.k8s.io/controller-runtime` minor (microsoft#2324, `0.23` → `0.24`, which requires k8s `v0.36`) fails the same way. This extends the group to `minor` updates so the whole lockstep set ships as one PR. Majors stay excluded — k8s.io core modules are perpetually `v0.x`, so the release train is always a minor. ## Related Issue N/A — follow-up from reviewing failing dependabot updates. ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. - [ ] I have added tests, if applicable. (N/A — dependabot config.) ## Screenshots (if applicable) or Testing Completed YAML parses clean; dependabot validates the config on its next scheduled run — config-only change. ## Additional Notes After this merges, close microsoft#2329 and microsoft#2324; the next daily gomod run will regenerate them as a single grouped `k8s` PR containing the coherent `v0.36` set. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
Laksh (lakshk98)
pushed a commit
to lakshk98/retina
that referenced
this pull request
Aug 4, 2026
# Description The `k8s` dependabot group only covers `patch` updates, so k8s release trains (`v0.35` → `v0.36` across `k8s.io/api`, `apimachinery`, `client-go`, `kubectl`, `metrics`, …) arrive as individual PRs. Those modules version in lockstep, so a lone bump is unresolvable — microsoft#2329 has been failing dependency resolution for weeks: ``` k8s.io/metrics | dependency_file_not_resolvable | "go: ...k8s.io/kubectl/pkg/scheme imports k8s.io/api/scheduling/v1alpha1: module k8s.io/api@latest found (v0.36.2), but does not contain package k8s.io/api/scheduling/v1alpha1" ``` The paired `sigs.k8s.io/controller-runtime` minor (microsoft#2324, `0.23` → `0.24`, which requires k8s `v0.36`) fails the same way. This extends the group to `minor` updates so the whole lockstep set ships as one PR. Majors stay excluded — k8s.io core modules are perpetually `v0.x`, so the release train is always a minor. ## Related Issue N/A — follow-up from reviewing failing dependabot updates. ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. - [ ] I have added tests, if applicable. (N/A — dependabot config.) ## Screenshots (if applicable) or Testing Completed YAML parses clean; dependabot validates the config on its next scheduled run — config-only change. ## Additional Notes After this merges, close microsoft#2329 and microsoft#2324; the next daily gomod run will regenerate them as a single grouped `k8s` PR containing the coherent `v0.36` set. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.1.
Release notes
Sourced from sigs.k8s.io/controller-runtime's releases.
... (truncated)
Commits
3be3f1bMerge pull request #3516 from k8s-infra-cherrypick-robot/cherry-pick-3515-to-...0f7b33dFix regression in Apply typed error handlingd3eaef3Merge pull request #3475 from alvaroaleman/fixfix3296f32🐛 Update typed Applyconfigurations with server responsec8b4b9dMerge pull request #3506 from troy0820/troy0820/update-deps-k8s557c314update to k8s.io v1.36.0e4a998cMerge pull request #3499 from kubernetes-sigs/dependabot/github_actions/all-g...1a31c56Merge pull request #3498 from vieux/fix-fake-client-generatename-retry80bc294fakeclient: retry GenerateName on AlreadyExists collisions (match K8s 1.32 be...77b730a🌱 Bump the all-github-actions group with 2 updates