Skip to content

Bump the go-dependencies group across 1 directory with 21 updates#751

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-dependencies-5a1606e702
Closed

Bump the go-dependencies group across 1 directory with 21 updates#751
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-dependencies-5a1606e702

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 31, 2026 •
edited
Loading

Bumps the go-dependencies group with 15 updates in the / directory:

Package From To
github.com/Azure/azure-sdk-for-go/sdk/azcore 1.18.0 1.21.0
github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry 0.2.2 0.2.3
github.com/andygrunwald/go-jira 1.16.0 1.17.0
github.com/aws/aws-sdk-go-v2 1.36.3 1.41.5
github.com/aws/aws-sdk-go-v2/config 1.29.14 1.32.13
github.com/aws/aws-sdk-go-v2/feature/s3/manager 1.17.72 1.22.10
github.com/aws/aws-sdk-go-v2/service/ecs 1.54.6 1.75.0
github.com/aws/aws-sdk-go-v2/service/lambda 1.71.2 1.88.5
github.com/containers/image/v5 5.34.3 5.36.2
github.com/go-playground/validator/v10 10.26.0 10.30.2
github.com/open-policy-agent/opa 1.13.2 1.15.1
github.com/zalando/go-keyring 0.2.6 0.2.8
golang.org/x/oauth2 0.34.0 0.36.0
k8s.io/kubernetes 1.35.0 1.35.3
sigs.k8s.io/kind 0.11.1 0.31.0

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.18.0 to 1.21.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.21.0

1.21.0 (2026-01-12)

Features Added

  • Added runtime/datetime package which provides specialized time type wrappers for serializing and deserializing time values in various formats used by Azure services.

Other Changes

  • Aligned cloud.AzureGovernment and cloud.AzureChina audience values with Azure CLI
Commits

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.9.0 to 1.10.1

Commits

Updates github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry from 0.2.2 to 0.2.3

Commits

Updates github.com/andygrunwald/go-jira from 1.16.0 to 1.17.0

Release notes

Sourced from github.com/andygrunwald/go-jira's releases.

v1.17.0

This is a maintenance release, but there are two important changes:

  • github.com/golang-jwt/jwt/v4 has been updated because of a security issue, see CVE-2025-30204
  • Minimum Go version has been raised from v1.15 to v1.21, due to an update of github.com/google/go-cmp

What's Changed

  • Replace ioutil.ReadFile with os.ReadFile
  • Replace ioutil.ReadAll with io.ReadAll
  • upgraded static v2022.1 => v2023.1
  • go fmt issue.go, metaissue.go, sprint.go
  • Github Actions: Upgrade dominikh/staticcheck-action from v1.2 to v1.4
  • Github Actions: Upgrade actions/setup-go from v3 to v6
  • Github Actions: Upgrade actions/checkout from v3 to v5
  • go mod tidy
  • upgraded github.com/google/go-cmp v0.5.8 => v0.7.0
  • upgraded go 1.15 => 1.21
  • upgraded github.com/golang-jwt/jwt/v4 v4.4.2 => v4.5.2

All these changes have been made by @​andygrunwald in andygrunwald/go-jira#735

Full Changelog: andygrunwald/go-jira@v1.16.1...v1.17.0

v1.16.1

This release is shipping a fix for the deprecation of the GET /rest/api/2/search endpoint. See Deprecation of JQL search and Evaluate expression endpoints / 31 October 2024.

If you are using a Jira Cloud-hosted instance and are using either IssueService.Search() or IssueService.SearchWithContext(), there is a high likelihood that these functions will no longer work for you due to deprecation and removal by Atlassian.

This release introduces IssueService.SearchV2JQL() and IssueService.SearchV2JQLWithContext() with a very similar function signature. To get the same results as with IssueService.Search() or IssueService.SearchWithContext(), you may need to configure a Fields list in the options parameter. Please see Search for issues using JQL enhanced search (GET) for further instructions.

What's Changed

New Contributors

Full Changelog: andygrunwald/go-jira@v1.16.0...v1.16.1

Changelog

Sourced from github.com/andygrunwald/go-jira's changelog.

1.17.0 (2025-09-16)

All changes in #735.

Breaking Changes

  • Minimum Go version increased from 1.15 to 1.21 (due to google/go-cmp dependency update)

Security

  • Updated github.com/golang-jwt/jwt/v4 v4.4.2 to v4.5.2 (CVE-2025-30204)

Maintenance

  • Replaced deprecated ioutil.ReadFile with os.ReadFile
  • Replaced deprecated ioutil.ReadAll with io.ReadAll
  • Replaced deprecated ioutil.Discard with io.Discard
  • Upgraded staticcheck v2022.1 to v2023.1
  • Code formatting updates (issue.go, metaissue.go, sprint.go)

Dependencies

  • github.com/google/go-cmp v0.5.8 to v0.7.0
  • github.com/golang-jwt/jwt/v4 v4.4.2 to v4.5.2

CI/CD

  • Upgraded actions/checkout from v3 to v5
  • Upgraded actions/setup-go from v3 to v6
  • Upgraded dominikh/staticcheck-action from v1.2 to v1.4

1.16.1 (2025-09-13)

Features

  • Added IssueService.SearchV2JQL() and IssueService.SearchV2JQLWithContext() to handle Atlassian's deprecation of GET /rest/api/2/search endpoint (effective October 31, 2024) (#725)

New contributor: @​conor-naranjo

Commits
  • 93f28dd Merge pull request #735 from andygrunwald/v1.17.0-dev-upgrade-dependencies
  • 00778a6 Replace ioutil.Discard with io.Discard
  • 44e617e Replace ioutil.ReadFile with os.ReadFile
  • 546b61f Replace ioutil.ReadAll with io.ReadAll
  • 79978f0 upgraded static v2022.1 => v2023.1
  • 463a8a0 go fmt sprint.go
  • e0ea06f go fmt metaissue.go
  • 2095c75 go fmt issue.go
  • 3d9306e Github Actions: Upgrade dominikh/staticcheck-action from v1.2 to v1.4
  • ead0c0c Github Actions: Upgrade actions/setup-go from v3 to v6
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.36.3 to 1.41.5

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.29.14 to 1.32.13

Commits

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.17.67 to 1.19.13

Commits

Updates github.com/aws/aws-sdk-go-v2/feature/s3/manager from 1.17.72 to 1.22.10

Commits

Updates github.com/aws/aws-sdk-go-v2/service/ecs from 1.54.6 to 1.75.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/lambda from 1.71.2 to 1.88.5

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.79.2 to 1.97.3

Commits

Updates github.com/aws/smithy-go from 1.22.3 to 1.24.2

Release notes

Sourced from github.com/aws/smithy-go's releases.

v1.22.4

Release (2025-06-16)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.22.4
    • Bug Fix: Fix CBOR serd empty check for string and enum fields
Commits

Updates github.com/containers/image/v5 from 5.34.3 to 5.36.2

Release notes

Sourced from github.com/containers/image/v5's releases.

v5.36.2

What's Changed

Full Changelog: containers/image@v5.36.1...v5.36.2

v5.36.1

What's Changed

Full Changelog: containers/image@v5.36.0...v5.36.1

v5.36.0

What's Changed

... (truncated)

Commits
  • d464a25 Bump to v5.36.2
  • 50a6b67 Merge pull request #2943 from TomSweeneyRedHat/dev/tsweeney/backport_2938
  • d3eb538 [release-5.36] rekor: do not cancel http context
  • 6ed8326 Merge pull request #2920 from TomSweeneyRedHat/dev/tsweeney/v5.36.1
  • f6ca2da [release-5.36] Bump to c/image v5.36.1
  • d18da19 [release-5.36] Bump c/storage to v1.59.1
  • ae0c9f3 Merge pull request #2913 from TomSweeneyRedHat/dev/tsweeney/cherrypick2907
  • 40d1027 [release-5.36] Update the CI image, to match Skopeo's updated test code
  • 08ce6b4 Bump to c/image v5.36.0
  • b5e2b66 Bump to c/storage v1.59.0
  • Additional commits viewable in compare view

Updates github.com/docker/docker from 28.0.4+incompatible to 28.3.2+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

28.3.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • Fix --use-api-socket not working correctly when targeting a remote daemon. docker/cli#6157
  • Fix stray "otel error" logs being printed if debug logging is enabled. docker/cli#6160
  • Quote SSH arguments when connecting to a remote daemon over an SSH connection to avoid unexpected expansion. docker/cli#6147
  • Warn when DOCKER_AUTH_CONFIG is set during docker login and docker logout. docker/cli#6163

Packaging updates

28.3.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Packaging updates

28.3.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New

... (truncated)

Commits

Updates github.com/go-playground/validator/v10 from 10.26.0 to 10.30.2

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

v10.30.2

What's Changed

New Contributors

Full Changelog: go-playground/validator@v10.30.1...v10.30.2

Release 10.30.1

What's Changed

New Contributors

Full Changelog: go-playground/validator@v10.30.0...v10.30.1

Release 10.30.0

What's Changed

New Contributors

... (truncated)

Commits
  • b9258bd fix(fqdn): allow hyphens in last domain label (#1548)
  • b9f1d79 feat: add postcode patterns for Colombia (CO) and British Virgin Islands (VG)...
  • 7fa9599 chore(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0 (#1546)
  • 8ca29ec chore(deps): bump golang.org/x/text from 0.34.0 to 0.35.0 (#1545)
  • 5e1bedf docs: add Valuer interface documentation and example (#1540)
  • 42927a0 feat: implement ValidatorValuer interface feature (#1416)
  • c254ece docs: fix typos (#1527)
  • 4325386 fix: prevent panic in unique validation with nil pointer elements (#1532)
  • d3f35da Go 1.26 support (#1535)
  • f5c74ce chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 (#1533)
  • Additional commits viewable in compare view

Updates github.com/hashicorp/go-retryablehttp from 0.7.7 to 0.7.8

Commits

@dependabot
Bump the go-dependencies group across 1 directory with 21 updates
4e4c47b 
Bumps the go-dependencies group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go) | `1.18.0` | `1.21.0` |
| [github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry](https://github.com/Azure/azure-sdk-for-go) | `0.2.2` | `0.2.3` |
| [github.com/andygrunwald/go-jira](https://github.com/andygrunwald/go-jira) | `1.16.0` | `1.17.0` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.36.3` | `1.41.5` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.29.14` | `1.32.13` |
| [github.com/aws/aws-sdk-go-v2/feature/s3/manager](https://github.com/aws/aws-sdk-go-v2) | `1.17.72` | `1.22.10` |
| [github.com/aws/aws-sdk-go-v2/service/ecs](https://github.com/aws/aws-sdk-go-v2) | `1.54.6` | `1.75.0` |
| [github.com/aws/aws-sdk-go-v2/service/lambda](https://github.com/aws/aws-sdk-go-v2) | `1.71.2` | `1.88.5` |
| [github.com/containers/image/v5](https://github.com/containers/image) | `5.34.3` | `5.36.2` |
| [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) | `10.26.0` | `10.30.2` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.13.2` | `1.15.1` |
| [github.com/zalando/go-keyring](https://github.com/zalando/go-keyring) | `0.2.6` | `0.2.8` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.34.0` | `0.36.0` |
| [k8s.io/kubernetes](https://github.com/kubernetes/kubernetes) | `1.35.0` | `1.35.3` |
| [sigs.k8s.io/kind](https://github.com/kubernetes-sigs/kind) | `0.11.1` | `0.31.0` |



Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.18.0 to 1.21.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.18.0...sdk/azcore/v1.21.0)

Updates `github.com/Azure/azure-sdk-for-go/sdk/azidentity` from 1.9.0 to 1.10.1
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.9.0...sdk/azidentity/v1.10.1)

Updates `github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry` from 0.2.2 to 0.2.3
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Commits](Azure/azure-sdk-for-go@sdk/internal/v0.2.2...sdk/internal/v0.2.3)

Updates `github.com/andygrunwald/go-jira` from 1.16.0 to 1.17.0
- [Release notes](https://github.com/andygrunwald/go-jira/releases)
- [Changelog](https://github.com/andygrunwald/go-jira/blob/main/CHANGELOG.md)
- [Commits](andygrunwald/go-jira@v1.16.0...v1.17.0)

Updates `github.com/aws/aws-sdk-go-v2` from 1.36.3 to 1.41.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.36.3...v1.41.5)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.29.14 to 1.32.13
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.29.14...config/v1.32.13)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.17.67 to 1.19.13
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@credentials/v1.17.67...credentials/v1.19.13)

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/manager` from 1.17.72 to 1.22.10
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@feature/s3/manager/v1.17.72...service/mq/v1.22.10)

Updates `github.com/aws/aws-sdk-go-v2/service/ecs` from 1.54.6 to 1.75.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ecs/v1.54.6...service/s3/v1.75.0)

Updates `github.com/aws/aws-sdk-go-v2/service/lambda` from 1.71.2 to 1.88.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/rds/v1.71.2...service/s3/v1.88.5)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.79.2 to 1.97.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.79.2...service/s3/v1.97.3)

Updates `github.com/aws/smithy-go` from 1.22.3 to 1.24.2
- [Release notes](https://github.com/aws/smithy-go/releases)
- [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md)
- [Commits](aws/smithy-go@v1.22.3...v1.24.2)

Updates `github.com/containers/image/v5` from 5.34.3 to 5.36.2
- [Release notes](https://github.com/containers/image/releases)
- [Commits](containers/image@v5.34.3...v5.36.2)

Updates `github.com/docker/docker` from 28.0.4+incompatible to 28.3.2+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v28.0.4...v28.3.2)

Updates `github.com/go-playground/validator/v10` from 10.26.0 to 10.30.2
- [Release notes](https://github.com/go-playground/validator/releases)
- [Commits](go-playground/validator@v10.26.0...v10.30.2)

Updates `github.com/hashicorp/go-retryablehttp` from 0.7.7 to 0.7.8
- [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md)
- [Commits](hashicorp/go-retryablehttp@v0.7.7...v0.7.8)

Updates `github.com/open-policy-agent/opa` from 1.13.2 to 1.15.1
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.13.2...v1.15.1)

Updates `github.com/zalando/go-keyring` from 0.2.6 to 0.2.8
- [Release notes](https://github.com/zalando/go-keyring/releases)
- [Commits](zalando/go-keyring@v0.2.6...v0.2.8)

Updates `golang.org/x/oauth2` from 0.34.0 to 0.36.0
- [Commits](golang/oauth2@v0.34.0...v0.36.0)

Updates `k8s.io/kubernetes` from 1.35.0 to 1.35.3
- [Release notes](https://github.com/kubernetes/kubernetes/releases)
- [Commits](kubernetes/kubernetes@v1.35.0...v1.35.3)

Updates `sigs.k8s.io/kind` from 0.11.1 to 0.31.0
- [Release notes](https://github.com/kubernetes-sigs/kind/releases)
- [Commits](kubernetes-sigs/kind@v0.11.1...v0.31.0)

---
updated-dependencies:
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azcore
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azidentity
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry
  dependency-version: 0.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/andygrunwald/go-jira
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.41.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.32.13
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.19.13
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/manager
  dependency-version: 1.22.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecs
  dependency-version: 1.75.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/lambda
  dependency-version: 1.88.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.97.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/smithy-go
  dependency-version: 1.24.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/containers/image/v5
  dependency-version: 5.36.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/docker/docker
  dependency-version: 28.3.2+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/go-playground/validator/v10
  dependency-version: 10.30.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/hashicorp/go-retryablehttp
  dependency-version: 0.7.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/zalando/go-keyring
  dependency-version: 0.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: k8s.io/kubernetes
  dependency-version: 1.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: sigs.k8s.io/kind
  dependency-version: 0.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 31, 2026
@claude
Copy link
Copy Markdown
Contributor

claude bot commented Mar 31, 2026 •
edited
Loading

Claude finished @dependabot[bot]'s task in 2m 14s —— View job

Dependency Update Review

  • Identify changed dependencies
  • Review go.mod diff for breaking changes
  • Analyze usage of critical dependencies in codebase
  • Check for API changes, deprecations, and risks
  • Post final review

Summary

This PR bumps 21 Go dependencies (15 direct, 6 indirect). I've analyzed each upgraded dependency against its usage in this codebase. Overall the upgrade looks safe, with one item worth attention.

Risk Assessment by Dependency

sigs.k8s.io/kind v0.11.1 → v0.31.0 — ⚠️ Medium Risk

This is the largest jump in the PR (20 minor versions). Used only in test infrastructure (internal/kube/kube_test.go) for creating temporary Kind clusters. The APIs used (cluster.NewProvider(), cluster.ProviderWithDocker(), cluster.CreateWithWaitForReady(), provider.Create(), provider.Delete(), provider.ExportKubeConfig()) are core lifecycle APIs and likely stable, but given the magnitude of the jump, integration tests that exercise Kind cluster creation should be run to verify (make test_integration_full — the K8s tests that are skipped in --short mode).

github.com/aws/smithy-go v1.22.3 → v1.24.2 — ✅ Low Risk

Bumped minimum Go to 1.24. This project uses Go 1.25.0 (go.mod line 3), so no compatibility issue. Used in internal/azure/azure_apps.go for smithyTime.ParseDateTime() — a stable utility function.

AWS SDK v2 packages (multiple) — ✅ Low Risk

All AWS SDK packages are minor/patch bumps within v2. The codebase uses standard, stable APIs:

  • ECS: ListClusters, DescribeClusters, ListServices, DescribeServices, ListTasks, DescribeTasks
  • Lambda: ListFunctions, GetFunctionConfiguration
  • S3: ListObjectsV2 (paginator), Download (manager)

No deprecated APIs are in use. The Lambda pagination uses Marker/NextMarker which is the correct pattern for ListFunctions. New indirect dependency aws/aws-sdk-go-v2/service/signin was added — this is a transitive dependency and not directly used.

github.com/containers/image/v5 v5.34.3 → v5.36.2 — ✅ Low Risk

The release notes mention an INCOMPATIBLE change: removal of the ostree transport. This codebase does not use the ostree transport. Only two packages are used (docker.ParseReference, docker.GetDigest, types.SystemContext, types.DockerAuthConfig in internal/digest/digest.go) — all stable, core APIs.

github.com/open-policy-agent/opa v1.13.2 → v1.15.1 — ✅ Low Risk

Used in internal/evaluate/rego.go via the v1 API (v1/ast, v1/rego). Only standard evaluation APIs are used (rego.New, rego.Query, rego.Module, rego.Input, rego.Eval, ast.ParseModuleWithOpts). These are stable v1 interfaces.

github.com/andygrunwald/go-jira v1.16.0 → v1.17.0 — ✅ Low Risk

Maintenance release. Minimum Go raised to 1.21 (this project uses 1.25.0 ✓). Includes a security fix for golang-jwt/jwt/v4 (CVE-2025-30204). Used in internal/jira/jira.go for BasicAuthTransport, BearerAuthTransport, Issue.Get — all unchanged APIs.

github.com/go-playground/validator/v10 v10.26.0 → v10.30.2 — ✅ Low Risk

Used in cmd/kosli/snapshotPaths.go and internal/server/server.go with basic tags (required, oneof). No breaking changes to these core validation features. New features (CMYK color validation, ValidatorValuer interface, omitzero) don't affect existing usage.

github.com/zalando/go-keyring v0.2.6 → v0.2.8 — ✅ Low Risk

Patch bump. Used in internal/security/security.go for keyring.Get, keyring.Set, keyring.ErrNotFound, keyring.MockInit — stable, minimal API surface.

Other low-risk updates

Dependency Change Notes
Azure/azure-sdk-for-go/sdk/azcore 1.18.0 → 1.21.0 Additive: new runtime/datetime package
Azure/azure-sdk-for-go/sdk/azidentity 1.9.0 → 1.10.1 Patch-level fixes
Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry 0.2.2 → 0.2.3 Patch fix
docker/docker 28.0.4 → 28.3.2 Minor bump, additive features
hashicorp/go-retryablehttp 0.7.7 → 0.7.8 Patch: new RateLimitLinearJitterBackoff policy
k8s.io/kubernetes 1.35.0 → 1.35.3 Patch fixes
golang.org/x/oauth2 0.34.0 → 0.36.0 Standard library extension

Removed indirect dependencies (expected)

  • github.com/alessio/shellescape — not directly imported, safe removal
  • gopkg.in/ini.v1 — not directly imported, safe removal
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp — transitive cleanup

Recommendations

  1. Run make test_integration_full (including K8s tests) to validate the Kind v0.31.0 upgrade — this is the highest-risk change due to the version gap.
  2. Standard integration tests (make test_integration) should cover AWS, Azure, OCI, Jira, OPA, and validator paths.
  3. No code changes required — all APIs in use remain stable across these upgrades.

@mbevc1
Copy link
Copy Markdown
Contributor

mbevc1 commented Mar 31, 2026

@dependabot rebase

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Mar 31, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Mar 31, 2026
@dependabot dependabot bot deleted the dependabot/go_modules/go-dependencies-5a1606e702 branch March 31, 2026 16:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mbevc1