deps: bump helm.sh/helm/v3 from 3.21.1 to 3.21.3 - #2544
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
dependabot
Bot
added
area/dependencies
dependabot
Bot
added
the
area/dependencies
Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.21.1 to 3.21.3. - [Release notes](https://github.com/helm/helm/releases) - [Commits](helm/helm@v3.21.1...v3.21.3) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-version: 3.21.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/go_modules/helm.sh/helm/v3-3.21.3
branch
from
July 20, 2026 19:38
077e990 to
84c3548
Compare
7 tasks
Contributor
Author
|
Superseded by #2587. |
pull Bot
pushed a commit
to weiyilai/retina
that referenced
this pull request
Jul 27, 2026
# Description Dependabot splits three dependency families that must move together, so each PR is unmergeable on its own. **codeql-action** — `codeql.yaml` pins `init`, `autobuild` and `analyze` to one SHA, and CodeQL rejects mixed versions. `actions-patch` covers `patch` only, so minor bumps get one PR per sub-action and every `Analyze` job fails: ``` ##[error]Loaded a configuration file for version '4.36.3', but running version '4.37.2' ``` That is microsoft#2573, microsoft#2574 and microsoft#2575. **k8s** — `helm.sh/helm/v3` is in no group but pins `k8s.io/client-go` transitively (`v3.21.3` needs `v0.36.2`, `controller-runtime v0.23.3` needs `v0.35.0`). Bumping helm alone fails on `handlerRegistration does not implement cache.ResourceEventHandlerRegistration (missing method HasSyncedChecker)`, so microsoft#2544 and microsoft#2324 are two halves of one change. **cilium** — `cilium/cilium v1.19.3` pins `hive`, `statedb` and `stream` to exactly retina's versions; moving them alone breaks cilium's own source (microsoft#2543, microsoft#2520). ## Changes - **codeql-action**: group over `github/codeql-action*`, covering all four sub-actions in `codeql.yaml` and `trivy.yaml`. `actions-patch` gets a matching `exclude-patterns`: with no `patterns` of its own it scores 500 against the new group's 106, so it would otherwise claim these and then drop them for not being `patch`. - **k8s**: adds `helm.sh/helm/v3` and the exact path `sigs.k8s.io/cloud-provider-azure/pkg/azclient/configloader`, which pins client-go the same way. An exact path scores 1000, outranking `azure-sdk`. The exclusion narrows to `pkg/azclient`, which has no client-go dependency. - **cilium**: ignore `hive`, `statedb` and `stream`. MVS still raises them when `cilium/cilium` moves. - **otel**: widened to `minor`; `1.43.0` → `1.44.0` arrived as three PRs (microsoft#2408, microsoft#2409, microsoft#2410). ## Related Issue N/A. ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). See [this documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification) on signing commits. - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. - [ ] I have added tests, if applicable. ## Screenshots (if applicable) or Testing Completed Local run against the real updater image: `main` produces three ungrouped codeql PRs, this config produces one holding all four. Dropping `exclude-patterns` reproduces `main` exactly. Hosted Dependabot on a fork: | PR | Contents | |---|---| | codeql-action, 4 updates | all four sub-actions on one SHA, `v4.37.3` | | k8s, 7 updates | helm `3.21.1` → `3.21.3`, controller-runtime `0.23.3` → `0.24.1`, `k8s.io/*` → `0.36.2` | | cilium, 4 updates | `cilium/cilium` `v1.19.3` → `v1.19.6` with `ebpf v0.22.0` and `statedb v0.5.9`, as `v1.19.6` requires | Schema-validates against `dependabot-2.0.json` with no new errors versus `main`. ## Additional Notes `configloader` stays put until the k8s group lands: its bump raises `k8s.io/api` to `0.36.x` while `kubectl` stays at `0.35.3`, whose `pkg/scheme` imports `k8s.io/api/scheduling/v1alpha1`, removed in `0.36`. `go mod tidy` fails with it alone and passes with the full set, so no extra config is needed. Once this lands, microsoft#2573, microsoft#2574, microsoft#2575, microsoft#2544, microsoft#2324, microsoft#2543 and microsoft#2520 can be closed. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps helm.sh/helm/v3 from 3.21.1 to 3.21.3.
Release notes
Sourced from helm.sh/helm/v3's releases.
... (truncated)
Commits
1ad6e68Apply suggestions from code review037733efix: drop containerd v1 dep to resolve govulncheck CVEsd3e178bchore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.331259634chore(deps): bump the k8s-io group with 2 updatesb52e276fixes3342dbfchore(deps): bump the k8s-io group across 1 directory with 2 updates