Skip to content

chore(deps): update go indirect - #300

Open
bootc-bot[bot] wants to merge 1 commit into
mainfrom
bootc-renovate/go-indirect
Open

chore(deps): update go indirect#300
bootc-bot[bot] wants to merge 1 commit into
mainfrom
bootc-renovate/go-indirect

Conversation

@bootc-bot

@bootc-bot bootc-bot Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update
github.com/MakeNowJust/heredoc v1.0.0 → v2.0.1 age confidence indirect major
github.com/aws/aws-sdk-go-v2/credentials v1.20.13 → v1.20.16 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.5 → v1.20.8 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.8 → v1.5.11 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.8 → v2.8.11 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.8 → v1.5.11 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.23 → v1.13.24 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.8 → v1.14.11 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/service/signin v1.12.1 → v1.12.4 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/service/sso v1.39.1 → v1.39.4 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.44.1 → v1.44.4 age confidence indirect patch
github.com/aws/aws-sdk-go-v2/service/sts v1.51.6 → v1.51.9 age confidence indirect patch
github.com/aws/smithy-go v1.28.7 → v1.28.8 age confidence indirect patch
github.com/docker/cli v29.9.2+incompatible → v29.9.3+incompatible age confidence indirect patch
github.com/pandatix/go-abnf v0.5.3 → v0.5.5 age confidence indirect patch
github.com/spf13/pflag v1.0.10 → v1.1.0 age confidence indirect minor
go.yaml.in/yaml/v2 v2.4.4 → v4.0.0 age confidence indirect major
go.yaml.in/yaml/v3 v3.0.6 → v4.0.0 age confidence indirect major
gomodules.xyz/jsonpatch/v2 v2.4.0 → v3.0.1 age confidence indirect major
gopkg.in/evanphx/json-patch.v4 v4.13.0 → v5.9.11 age confidence indirect major
k8s.io/cli-runtime v0.37.1 → v0.37.2 age confidence indirect patch
k8s.io/component-base v0.37.1 → v0.37.2 age confidence indirect patch
k8s.io/kube-openapi d427ff9 → 5bee61f age confidence indirect digest
k8s.io/utils be93311 → ca04ba5 age confidence indirect digest
sigs.k8s.io/json 2d32026 → 11ed52e age confidence indirect digest
sigs.k8s.io/kustomize/api v0.21.1 → v0.21.2 age confidence indirect patch
sigs.k8s.io/kustomize/kyaml v0.21.1 → v0.21.2 age confidence indirect patch

Release Notes

MakeNowJust/heredoc (github.com/MakeNowJust/heredoc)

v2.0.1

Compare Source

Version 2.0.1

Fixes

  • Correct import path for Go modules

v2.0.0

Compare Source

Version 2.0.0

Breaking Changes

  • Treats only white space (U+0020) and horizontal tabs (U+000D) as space characters. (#​6)
aws/smithy-go (github.com/aws/smithy-go)

v1.28.8

Compare Source

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.8
    • Bug Fix: Preserve the exact value of numbers in JSON codec instead of automatically parsing to float64.
docker/cli (github.com/docker/cli)

v29.9.3+incompatible

Compare Source

pandatix/go-abnf (github.com/pandatix/go-abnf)

v0.5.5

Compare Source

Changelog

  • fc74189 Improve parsing efficiency with a lookahead, fix testdata and nullable elements validation (#​277)

v0.5.4

Compare Source

Changelog

  • 4634a67 Update ClusterFuzzLite setup and keep fuzz files out of main package by default (#​275)
spf13/pflag (github.com/spf13/pflag)

v1.1.0

Compare Source

It's been long enough, and enough things have been fixed, that it might be time to release a new version, even if there isn't any particular big new issue to market as the reason for this release.

If you notice anything breaking, it is entirely un-intentional, but you might also have been relying on undocumented or buggy behavior. Please file an issue describing what you're doing, how it worked before this release and why it doesn't work anymore, and pin your projects to v1.0.10 (the latest release before this one) while we decide how to address your concerns.

What's Changed

New Contributors

Full Changelog: spf13/pflag@v1.0.10...v1.1.0

yaml/go-yaml (go.yaml.in/yaml/v2)

v4.0.0: go-yaml v4.0.0

Compare Source

go-yaml v4.0.0

go-yaml v4.0.0 is the first stable release of the v4 series, maintained by the
YAML organization.
It adds configurable loading and dumping, public plugin interfaces, structured
errors, and a CLI for inspecting YAML processing.
The classic APIs remain supported, so applications can adopt v4 incrementally.

Getting started

Install the release:

go get go.yaml.in/yaml/v4@v4.0.0

Use this import path in your Go code:

import "go.yaml.in/yaml/v4"

For an existing v3 application, start by updating imports, reviewing custom
unmarshalers, and running your tests.
You can continue using Unmarshal, Marshal, NewDecoder, and NewEncoder.
The v2 and v3 APIs remain frozen, with security fixes only; new features and
routine bug fixes are developed in v4.

Why add Load and Dump?

Applications need different YAML policies: strict configuration validation,
particular output layouts, or custom anchor handling.
The new Load and Dump functions and streaming Loader and Dumper accept
functional options and plugins for those choices.
They use YAML's load/dump terminology and are recommended for new code.

The classic entry points keep compatibility settings rather than changing
formatting and error presentation for every existing caller.
Moving to the new API is an explicit choice to use v4 defaults, with presets
available when you want older settings.
Classic APIs remain supported.

For example, load a configuration with strict field checking, then choose its
output indentation:

package main

import (
    "fmt"
    "log"

    "go.yaml.in/yaml/v4"
)

func main() {
    var config struct {
        Name string `yaml:"name"`
        Port int    `yaml:"port"`
    }
    input := []byte("name: api\nport: 8080\n")
    if err := yaml.Load(input, &config, yaml.WithKnownFields()); err != nil {
        log.Fatal(err)
    }
    output, err := yaml.Dump(config, yaml.WithIndent(4))
    if err != nil {
        log.Fatal(err)
    }
    fmt.Print(string(output))
}

Unknown struct fields are ignored by default; WithKnownFields() opts into
rejecting them.
Duplicate mapping keys are rejected by default.
Options apply in order, so later options override earlier settings.

Defaults and compatibility

Setting Classic Marshal / Unmarshal Load / Dump defaults
Output indentation 4 spaces 2 spaces
Sequence indentation Non-compact Compact
Quote preference Legacy mixed quoting Single quotes where possible
Preferred output width Unlimited for Marshal 80 characters
Error presentation v3 style v4 style with stage and position

Quoting still depends on scalar content and styles, and line width is a
preference rather than a guaranteed maximum.
NewDecoder uses v3 error formatting; NewEncoder retains v3 output settings
with v4 error formatting.

Choose WithV3Defaults() to select compatibility defaults through the new API.
When replacing Marshal, also disable wrapping to match its line-width setting:

output, err := yaml.Dump(config,
    yaml.WithV3Defaults(),
    yaml.WithLineWidth(-1),
)

Presets select defaults; they do not reverse every v4 bug fix or reproduce every
legacy code path.
For example, package-level Load requires exactly one document, whereas
Unmarshal retains legacy handling of empty input and trailing content.
WithSingleDocument() deliberately skips validation of later documents.
Use WithAllDocuments() to load or dump slices as document streams, or use a
streaming loader or dumper to process documents individually.

Options, plugins, and nodes

Options control indentation, sequence layout, quoting, document markers,
Unicode escaping, field validation, and more.
OptsYAML accepts YAML configuration for supported settings, which can also be
shared with the CLI.

The public plugin APIs cover six areas:

  • Loader-Limits: configure depth and alias expansion checks.
  • Merge-Key: control merge directives and mapping conflicts, or replace the
    merge algorithm.
  • Alias-Data: supply external anchors, retain anchors across documents, use
    dotted paths, or reject alias references.
  • Error-format: select error presentation or implement a custom formatter.
  • YAML-parser: select an alternative parser implementation.
  • Tab-indent: opt into tab-aware input and output indentation.

The core module provides implementations for these APIs.
Additional parsers live in separate modules, keeping their dependencies optional.
Existing depth and alias protections remain enabled by default.

yaml.Node gives access to tags, styles, comments, anchors, and source positions.
Node.Load and Node.Dump accept options for node conversion.
Pass construction options explicitly inside custom unmarshaler hooks;
Node.Load starts with fresh defaults independently of its calling loader.
Stream nodes can expose encoding and YAML directives.
Node output retains supported styles and comments without promising identical
source formatting.

Migration details to check

NewLoader and NewDumper return errors; check them before using the stream.
Check dumper Dump and Close errors as well.

Custom UnmarshalYAML(*yaml.Node) error hooks must use the v4 node type.
Recognized v3 node hooks produce a migration error rather than silently losing
custom behavior.
The legacy UnmarshalYAML(func(any) error) error callback remains supported.

Conversion failures return structured *yaml.LoadErrors values.
Use errors.As to inspect structured errors or match legacy *yaml.TypeError
values, rather than relying on a direct type assertion or fixed message text.

Review the migration guide
for the complete compatibility guidance.

Inspect YAML with the CLI

Install the CLI from this release:

go install go.yaml.in/yaml/v4/cmd/go-yaml@v4.0.0

Convert to JSON, inspect nodes, or examine scanner and parser output:

go-yaml -J config.yaml
go-yaml -N config.yaml
go-yaml -T config.yaml
go-yaml -E config.yaml

The CLI also supports reusable options files and pipelines between intermediate
stages, making small bug reports easier to reproduce.
Runtime plugin selection chooses implementations already linked into the binary.

Further reading and thanks

See the options guide,
plugin guide,
CLI guide,
and API reference.
Please report problems with minimal input, a reproducer, and your Go version in
the issue tracker.

Release-candidate users should update to v4.0.0 and rerun their tests, as some APIs
changed during prerelease development.
Thanks to everyone who tested, reported problems, and contributed to this release.

v3.0.6

Compare Source

v3.0.5

Compare Source

v3.0.4

Compare Source

v3.0.3

Compare Source

v3.0.2

Compare Source

v3.0.1

Compare Source

v3.0.0

Compare Source

v2.4.5

Compare Source

gomodules/jsonpatch (gomodules.xyz/jsonpatch/v2)

v3.0.1

Compare Source

This release uses our forked gomodules/orderedmap library. Our forked version has 2 major changes:

  • Uses *OrderedMap instead of OrderedMap inside nested orderedmaps.
  • I ported unstructured helpers from Kubernetes to work with orderedmaps.

v3.0.0

Compare Source

This release uses iancoleman/orderedmap to generate predictable patch. This is very useful if the generated patch is checked into a VCS like git.

v2.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: gomodules/jsonpatch@v2.4.0...v2.5.0

kubernetes/cli-runtime (k8s.io/cli-runtime)

v0.37.2

Compare Source

kubernetes/component-base (k8s.io/component-base)

v0.37.2

Compare Source

kubernetes-sigs/kustomize (sigs.k8s.io/kustomize/api)

v0.21.2

#​5831: Add labels to volumeClaimTemplates in StatefulSets if includeVolumeClaimTemplates is true
#​6029: Account for delimiters in structured data replacements
#​6056: kyaml: mark ValidatingAdmissionPolicy resources as cluster-scoped
#​6075: update go 1.25.7
#​6078: bump go-git and x/crypt
#​6085: update otel lib to v1.40.0
#​6087: Reject ambiguous resource paths with inner ".." to prevent silent misresolution
#​6134: drop 'go-spew' dependencies and update dependencies
#​6138: bump k8s.io/kube-openapi, drop github.com/mailru/easyjson
#​6167: fix: match image digests with any algorithm, not only sha256
#​6184: fix: do not panic on an invalid image name regexp
#​6186: bump/go v1.26.5
#​6187: update vuln dependencies at 2026/07
#​6236: chore: bump stretch/testify pkg to remove old yaml dependencies
#​6237: fix: preserve Secret stringData during generator merge
#​6239: fix: add CronJob Image Volume support to images transformer
#​6242: fix: reject flag-like helmCharts releaseName and name values
#​6249: build(deps): bump go.yaml.in/yaml/v2 from 2.4.2 to 2.4.4
#​6251: build(deps): bump github.com/go-errors/errors from 1.4.2 to 1.5.1
#​6254: build(deps): bump github.com/google/gnostic-models from 0.7.0 to 0.7.1
#​6255: build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12
#​6256: build(deps): bump golang.org/x/sys from 0.45.0 to 0.47.0
#​6267: build(deps): bump golang.org/x/sys from 0.47.0 to 0.48.0
#​6273: bump go-git, kin-openapi and k8s.io
#​6274: build: use the golangci-lint v2 with release binary
#​6296: build: run Go tools with go tool
#​6305: Update kyaml to v0.21.2

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "on sunday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@bootc-bot
chore(deps): update go indirect
da14c99 
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
@bootc-bot

bootc-bot Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.26.10 -> 1.27.0
github.com/aws/aws-sdk-go-v2 v1.47.5 -> v1.47.8
k8s.io/api v0.37.1 -> v0.37.2
k8s.io/apimachinery v0.37.1 -> v0.37.2
k8s.io/client-go v0.37.1 -> v0.37.2

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants