fix(deps): update all non-major go dependencies - #1126
Merged
Merged
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
Bot
force-pushed
the
renovate/all-non-major-go-dependencies
branch
from
September 30, 2026 09:18
1466ad4 to
e8fed31
Compare
| datasource | package | from | to | | ---------- | ---------------------------------------- | ------- | ------- | | go | github.com/cert-manager/cert-manager | v1.21.1 | v1.21.2 | | go | github.com/cloudnative-pg/cloudnative-pg | v1.30.0 | v1.30.1 | | go | github.com/onsi/ginkgo/v2 | v2.32.1 | v2.33.0 | | go | github.com/onsi/gomega | v1.43.0 | v1.44.0 | | go | google.golang.org/grpc | v1.83.2 | v1.84.0 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/all-non-major-go-dependencies
branch
from
September 30, 2026 09:33
e8fed31 to
fc24b48
Compare
mnencia
approved these changes
Sep 30, 2026
mnencia
pushed a commit
that referenced
this pull request
Sep 30, 2026
🤖 I have created a release *beep* *boop* --- ## [0.15.1](v0.15.0...v0.15.1) (2026-09-30) ### Bug Fixes * **deps:** Update all non-major go dependencies ([#1126](#1126)) ([1eb1d14](1eb1d14)) * **deps:** Update dependency barman to v3.20.1 ([#1121](#1121)) ([d423ab8](d423ab8)) * **deps:** Update kubernetes monorepo to v0.37.1 ([#1127](#1127)) ([283e9c0](283e9c0)) * **deps:** Update module sigs.k8s.io/controller-runtime to v0.25.1 ([#1096](#1096)) ([86cf846](86cf846)) * **deps:** Upgrade dagger to gRPC-Go v1.83.2 ([#1134](#1134)) ([03e51f2](03e51f2)) * Log transient connectivity errors during WAL restore ([#1112](#1112)) ([01637c9](01637c9)), refs [#1111](#1111) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Signed-off-by: Peggie <info@cloudnative-pg.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.21.1→v1.21.2v1.30.0→v1.30.1v2.32.1→v2.33.0v1.43.0→v1.44.0v1.83.2→v1.84.0Release Notes
cert-manager/cert-manager (github.com/cert-manager/cert-manager)
v1.21.2Compare Source
cloudnative-pg/cloudnative-pg (github.com/cloudnative-pg/cloudnative-pg)
v1.30.1Compare Source
Release date: Sep 23, 2026
Enhancements
Added
restoreAdditionalCommandArgsto.barmanObjectStore.datafor in-tree Barman Cloud recoveries, so custom flags are forwarded tobarman-cloud-restoreduring recovery. (#11278)Plugin authors no longer need to re-derive whether an empty WAL archive should be treated as an error: the operator now computes the
check_empty_wal_archivedecision once and passes it to CNPG-I plugins on both WAL archiving and restore hooks. (#11216)Allowed setting the
ssl_ecdh_curvePostgreSQL parameter in.spec.postgresql.parameters. It was previously rejected by the validating webhook even though the operator does not manage it. Contributed by @Jamstah. (#11308)Added support for setting
auth_userinspec.pgbouncer.parametersto override the user PgBouncer uses for itsauth_queryconnection, instead of always deriving it from theauthQuerySecret. Useful with a customauthQuerySecretwhere the role to authenticate as differs from the one implied by the Secret. Contributed by @jonasbadstuebner. (#10899)Fixed PgBouncer metrics silently reporting zero when PgBouncer adds or reorders columns:
SHOW STATSandSHOW POOLSresults are now matched by column name instead of by position. Contributed by @AdzerKI (SHOW STATS). (#11366, #11464)cnpgplugin:--dry-runoption to thebackupcommand that prints theBackupresource that would be created, without creating it. (#11233)Security and Supply Chain
Fixed a webhook validation bypass where an absolute extension path with an embedded
..traversal (e.g./a/../../../../etc) was accepted because only the raw path was checked; such paths still escaped the extension's mount point once resolved at runtime. Affected entries are now resolved and rejected/skipped consistently across admission, the major-upgrade job, and already-persisted Cluster specs. Contributed by @Anand-240. (#11210)Updated
google.golang.org/grpcto v1.83.1, fixing CVE-2026-84304 / GHSA-vp52-pcj8-j9qc (gRPC-Go heap memory exhaustion via HTTP/2 DATA frame fragmentation). (#11394)Changes
Updated the default PostgreSQL operand image to 18.6-system-trixie. (#11257)
Moved the operator's own base image from Debian 12 (bookworm) to Debian 13 (trixie), now that Debian 12 has moved to LTS-only maintenance. (#11193)
Fixes
Demoted an unreachable old primary immediately during failover, instead of waiting on checkpoint and fast-shutdown attempts that could never complete. Previously, an old primary whose PostgreSQL had become unresponsive was never shut down, so it could never rejoin the cluster as a replica of the new primary. The shutdown is now requested without blocking the reconciler, though demotion can still take up to a minute or more if PostgreSQL keeps ignoring shutdown signals. (#11347)
Fixed failover and Pod recreation getting stuck while any instance in the cluster was fenced. A fenced instance kept reporting itself as healthy on its status endpoint even though its Pod was permanently not Ready, which blocked the readiness guard, the primary-election logic, and the Pod-reattachment gate from reacting to an unrelated failure elsewhere in the cluster, leaving it stalled until someone manually removed the fencing. All three now recognize and skip fenced instances. (#11274)
Fixed a failover that could stall forever or get silently reverted. While a failover was pending, the reconciler could skip checking whether it was ready to complete, or mistake the pending state for a missing Pod and reset the target primary back to the unhealthy one. It now keeps progressing a pending failover and completes it once the WAL receivers are down, rechecking quorum safety right before promoting in case it changed while waiting. (#11336)
Fixed the designated-primary sort in
PostgresqlStatusListso a tie on LSN no longer sorts it out of order. If the designated primary's Pod later disappeared from the status list, this could have led the operator to promote the wrong standby. (#11494)Gated PostgreSQL startup on the instance manager actually holding the primary
Lease, closing a window where a restarting or rescheduled primary could start accepting writes before acquiring the lease. Lease acquisition now happens during instance initialization, strictly before PostgreSQL is allowed to start, instead of only later in the reconciliation loop once the instance was already reported ready. (#11356)Bounded the primary lease take-over
Getcall to the lease'sRenewDeadline, so a call against an unreachable API server now fails fast and retries instead of blocking indefinitely. Left unbounded, the same stalled call could also delay a primary's own lease renewal after a transient API server blip, risking an unwanted takeover by another instance once the lease appeared to expire. (#11350)Stopped abandoning a fast shutdown after 60 seconds. The request carried no explicit timeout, so
pg_ctlfell back to its own implicit 60-second limit, and the instance manager, being PID 1 in the container, took PostgreSQL down mid-shutdown regardless of a larger configuredstopDelay. The fast phase now waits for the fullstopDelayinstead. (#11263)Waited for certificate status before refreshing secrets during bootstrap. (#11450)
Fixed in-tree Barman Cloud recovery ignoring
wal.maxParallelandwal.restoreAdditionalCommandArgs, fetching WAL one segment at a time instead of using the configured parallelism. (#11105)Honored the
unrecoverableannotation on pending and terminating instances. (#11241)Honored
Backup.spec.onlinewhen finalizing VolumeSnapshot-based backups, so a cold backup is no longer reported as online in status. (#11276)Set
--no-data-checksumsexplicitly when.spec.postgresql.dataChecksumsisfalseon PostgreSQL 18+, which now enables checksums by default ininitdb. Contributed by @evan314159. (#11488)Stopped discarding
.spec.inheritedMetadatalabels on PVC reconciliation; they were applied before, and then overwritten by, the operator's own labels. Contributed by @GellertBabel. (#11499)Stopped
PoolerandDatabaseRolefrom recreating their owned resources after being marked for deletion, which could block an external finalizer (e.g. ArgoCD foreground deletion) waiting for those resources to disappear. Contributed by @mjlshen. (#11359)Handled a
NULLstats_resetvalue in thepg_stat_walmetric, which could occasionally break Prometheus scraping on PostgreSQL 18 clusters. Contributed by @HoniSanders. (#11207)Recovered log streaming when a stale non-FIFO file blocked the log pipe. (#11246)
Stopped sampling logs of the Pods' processes, so no log lines are silently dropped. (#11131)
Stopped caching Helm release Secrets in the operator, which could spike memory usage and crashloop the operator on clusters with large Helm releases installed alongside it. (#11211)
Re-ran owned-resource finalizer cleanup after an operator restart, so a namespace deleted while the operator was down doesn't hang in
Terminatingforever. (#11215)Fixed rejoining replicas taking a long time to complete
pg_rewindwhen WAL prefetching (wal.maxParallel > 1) was enabled. (#11204)Treated a PostgreSQL instance rejecting connections as started up in probes. (#11152)
Stopped issuing a redundant PATCH on every reconciliation when a cluster's
pvcTemplatesetvolumeAttributesClass. Contributed by @andrew-farries. (#11196)Stopped halting replication slot reconciliation at the first failing slot. (#11119)
During rollouts, compared the running configuration hash, rather than the on-disk one, avoiding unnecessary switchovers. (#11130)
Retried
VolumeSnapshoterrors until the deadline, instead of giving up early. (#11132)Symlinked
pg_walto the WAL volume during plugin-based recovery, instead of replaying WAL onto the data volume, which could exhaust it on a large point-in-time recovery. (#11127)Corrected grammar in
PhaseUpgradeDelayedstatus messages. Contributed by @Utkarsh-sharma47. (#11065)CloudNativePG Interface (CNPG-I):
Terminatingstate when the operator and its plugins run in the same namespace. Contributed by @maxlengdell. (#10940)cnpgplugin:cnpg destroy, avoiding a race that could leave dangling PVCs needing a second invocation to clean up. Contributed by @daanvinken. (#10847)onsi/ginkgo (github.com/onsi/ginkgo/v2)
v2.33.0Compare Source
Features
ReportEntrys as<properties>on its<testcase>element, with the entry's name and its JSON-encoded value. Thanks @pohly! [23db51a]Maintenance
## Unreleasedas the work happens. See RELEASING.md. [8616ecb]v2.32.2Compare Source
2.32.2
Fixes
c6792b0]onsi/gomega (github.com/onsi/gomega)
v1.44.0Compare Source
Fixes
BeNumericallycompares signed and unsigned integers by value:-1no longer equalsuint64(math.MaxUint64)anduint(5)is now greater than-3(#925) [26e3c6b]BeNumerically("~")no longer overflows when computing the distance between extreme integers (#928) [1955764]BeNumerically("==", x, threshold)now honors the threshold for floats, as it already did for integers (#927) [10e2aca]HaveKeyWithValuesucceeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]HaveKeyandHaveKeyWithValuetreat key and value matcher errors likeContainElementdoes: a match wins, and an error is only reported when nothing matches (#926) [dc91598]MatchJSONno longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]MatchJSONcompares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7,630fe12]HaveExactElementsreports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]MatchYAMLcompares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing---) are ignored (#933) [2773796]MatchXMLignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89,2565350]v1.43.1Compare Source
Maintenance
d547015]## Unreleasedas the work happens. Releases still ship the stripped-down tree onmaster-lite- tests removed and Ginkgo dropped fromgo.mod- and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]grpc/grpc-go (google.golang.org/grpc)
v1.84.0: Release 1.84.0Compare Source
Behavior Changes
grpc.lb.pick_first.*metrics have been removed and replaced withgrpc.subchannel.*metrics. See gRFC A94 for more details. (#9215)New Features
contains_matchin route header matchers. (#9223)Bug Fixes
ClientConncould get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)Internalinstead of preserving the HTTP-mapped status code and response body. (#9217)Internalif invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)io.ErrUnexpectedEOFwhen EOF is encountered after partial header or message body reads. Previously, partial reads could return a plainio.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)PickResult.Metadata) and resolver addresses, failing the RPC with status codeInternalif invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)exact_matchstrings. (#9223)prefix_matchorsuffix_matchstrings. Previously, this caused a panic during route matching. (#9223)PrincipalorPermissionrules with:schemeorgrpc-prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)hostheader matchers to:authorityin nestedPrincipalandPermissionrules. Previously, this rewrite only applied to top-level rules, causing nestedhostmatchers to never match incoming requests and DENY policies to fail open. (#9258)CidrRangeswith an unset prefix length. Previously, an omittedprefix_lenfield caused a panic during RBAC configuration parsing. (#9250)Performance Improvements
GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZEenvironment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.