Skip to content

Bump the go-modules group across 1 directory with 9 updates - #319

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-2399e1fc23
Closed

Bump the go-modules group across 1 directory with 9 updates#319
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-2399e1fc23

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-modules group with 8 updates in the / directory:

Package From To
github.com/argoproj/argo-cd/v3 3.4.5 3.5.2
github.com/bitfield/script 0.24.3 0.25.0
github.com/getsops/sops/v3 3.13.2 3.13.3
github.com/stretchr/testify 1.11.1 1.12.1
golang.org/x/crypto 0.54.0 0.55.0
golang.org/x/net 0.57.0 0.58.0
k8s.io/apimachinery 0.36.2 0.37.0
k8s.io/code-generator 0.36.2 0.37.0

Updates github.com/argoproj/argo-cd/v3 from 3.4.5 to 3.5.2

Release notes

Sourced from github.com/argoproj/argo-cd/v3's releases.

v3.5.2

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

  • f1f109cc20895275ebae2dc62e51cba6c788586b: fix(appset): restore ignoreApplicationDifferences after normalization (cherry-pick #29070 for 3.5) (#29195) (@​argo-cd-cherry-pick-bot[bot])
  • a45dd38594f6f30bcc6c743e6f11080187cc84a1: fix(repository): resolve untyped helm source type in UpdateRevisionForPaths (cherry-pick #28904 for 3.5) (#29399) (@​argo-cd-cherry-pick-bot[bot])
  • 417c675b17207730f3b89ed579132267c9af4892: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.5) (#29224) (@​rumstead)
  • 961ee40cc32717bad323629284085b9f2cd7173f: fix(ui): remove kind filter from appset page (#29310) (#29311) (cherry-pick 3.5) (#29314) (@​crenshaw-dev)
  • cc1f3eef40dfee35842cc5a4c27a80b5f5dbe82e: fix(ui): show operation state on applications list page (cherry-pick release-3.5) (#29344) (@​antonu17)
  • 5accee3440f1a140de32071a035b783d653ce452: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.5) (#29273) (@​argo-cd-cherry-pick-bot[bot])
  • 4d99c524afda80d091dff81e8745eb3365285874: fix: recover from kubectl panic in AuthReconcile when SA is forbidden (cherry-pick #28669 for 3.5) (#29294) (@​alexymantha)

Dependency updates

  • 8b9e270fa2cefb4eb370609b38606bf1a3ae410e: chore(deps): update dependency dexidp/dex to v2.45.1 (#29334) (@​nitishfy)

Other work

  • e258ee23c3e52266d407572f4bcdfe7d9ed36cb5: chore: bump version to 3.5.2 on release-3.5 branch (#29404) (@​github-actions[bot])
  • a9d94d68c8a5bee4e1708f6640e7922b91736fec: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.5) (#29354) (@​argo-cd-cherry-pick-bot[bot])
  • cc1d7a2601ce87695808a2632687975a84900a54: fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.5) (#29345) (@​antonu17)

Full Changelog: argoproj/argo-cd@v3.5.1...v3.5.2

v3.5.1

Quick Start

... (truncated)

Commits
  • e258ee2 chore: bump version to 3.5.2 on release-3.5 branch (#29404)
  • c65a110 test: compile fix (release-3.5) (#29407)
  • a45dd38 fix(repository): resolve untyped helm source type in UpdateRevisionForPaths (...
  • 8b9e270 chore(deps): update dependency dexidp/dex to v2.45.1 (#29334)
  • a9d94d6 fix(notification-controller): deep-copy before mutating object from a shared ...
  • cc1d7a2 fix(notification-controller): read appprojects from informer cache (#28815) (...
  • cc1f3ee fix(ui): show operation state on applications list page (cherry-pick release-...
  • 961ee40 fix(ui): remove kind filter from appset page (#29310) (#29311) (cherry-pick 3...
  • 4d99c52 fix: recover from kubectl panic in AuthReconcile when SA is forbidden (cherry...
  • 5accee3 fix: don't degrade Cluster API Cluster health while Ready is False during pro...
  • Additional commits viewable in compare view

Updates github.com/bitfield/script from 0.24.3 to 0.25.0

Commits

Updates github.com/getsops/sops/v3 from 3.13.2 to 3.13.3

Release notes

Sourced from github.com/getsops/sops/v3's releases.

v3.13.3

Installation

To install sops, download one of the pre-built binaries provided for your platform from the artifacts attached to this release.

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.linux.amd64
Move the binary in to your PATH
mv sops-v3.13.3.linux.amd64 /usr/local/bin/sops
Make the binary executable
chmod +x /usr/local/bin/sops

Verify checksums file signature

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.checksums.txt
curl -LO https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.checksums.sigstore.json
Verify the checksums file
cosign verify-blob sops-v3.13.3.checksums.txt 
--bundle sops-v3.13.3.checksums.sigstore.json 
--certificate-identity-regexp=https://github.com/getsops 
--certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature:

# Verify the binary using the checksums file
sha256sum -c sops-v3.13.3.checksums.txt --ignore-missing

Verify artifact provenance

The SLSA provenance of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an in-toto link metadata file named sops-v3.13.3.intoto.jsonl. To verify the provenance of an artifact, you can utilize the slsa-verifier tool:

# Download the metadata file
curl -LO  https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.intoto.jsonl
</tr></table>

... (truncated)

Changelog

Sourced from github.com/getsops/sops/v3's changelog.

3.13.3

Improvements:

Bugfixes:

  • Fix a bug introduced in 3.13.2 that computes a wrong MAC during decryption for sequences (YAML lists) that contain a comment (#2245).
  • Fix completion subcommands so that they do not have an empty line before the shebang (#2253).

Project changes:

  • CI dependency updates (#2241, #2250, #2260).
  • Rust dependency updates for functional tests (#2259).
Commits
  • 26e2f47 Merge pull request #2249 from felixfontein/release-3.13.3
  • 357de8a Fix old changelog.
  • 73f38b8 Add changelog.
  • 74428b6 Bump version to 3.13.3.
  • f5fe6ab Merge pull request #2253 from felixfontein/completion
  • 238f71b Remove leading newline.
  • 5a745f3 Merge pull request #2248 from felixfontein/deps
  • f406e83 Update dependencies with 'go get -t -u ./...'.
  • 7149e91 Merge pull request #2259 from getsops/dependabot/cargo/functional-tests/rust-...
  • fefb6ee build(deps): Bump the rust group in /functional-tests with 3 updates
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.54.0 to 0.55.0

Commits
  • f44d03d go.mod: update golang.org/x dependencies
  • 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
  • b07833c ssh: return window credit for discarded extended data
  • d701c51 acme: fix nil pointer dereference in pebble test error reporting
  • 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
  • 90f76b8 ssh: reject certificate signature keys before recursing
  • b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
  • 626e40f ssh: drain stderr on forwarded TCP and Unix channels
  • 31914c6 x509roots/fallback: update bundle
  • f2135b8 all: clean up minor issues found by staticcheck
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.57.0 to 0.58.0

Commits
  • acc78e0 go.mod: update golang.org/x dependencies
  • 90d10f0 internal/http3: delete invalid Content-Length if declared in server handler
  • 08abf4d internal/http3: infer headers when Content-Encoding is set but is empty
  • 8d10596 http2: avoid deadlocks in wrapped ClientConn state callback
  • 99c3b0a http2/hpack: build the table lookup maps lazily, only for encoders
  • 5a920b1 http3: rework registration to allow using a fake network
  • 7fd2842 quic: return an error from Accept after PacketConn reader exits
  • 825111d quic: avoid busy-loop when keep-alive is blocked by congestion control
  • a02ddfa http/httpproxy: prioritize lowercase proxy environment variables
  • 574e5eb quic: halt conn goroutines on close when listener exits early
  • Additional commits viewable in compare view

Updates golang.org/x/text from 0.40.0 to 0.41.0

Commits
  • acdba66 go.mod: update golang.org/x dependencies
  • 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
  • See full diff in compare view

Updates k8s.io/apimachinery from 0.36.2 to 0.37.0

Commits
  • 7164e39 Update dependencies to v0.37.0 tag
  • e55f9ba feat(api): Update node restriction admission to use new API
  • cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis
  • 97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api
  • f21afab Add validation for camelcase in reason field
  • d7ad413 Merge pull request #140782 from dims/update-kube-openapi
  • e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist
  • 464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
  • 0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key
  • 95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...
  • Additional commits viewable in compare view

Updates k8s.io/code-generator from 0.36.2 to 0.37.0

Commits
  • 932621b Update dependencies to v0.37.0 tag
  • ad11b1b Bump CSI again
  • 6da4511 Update vendor to new CSI spec
  • 82c4ba9 Merge pull request #140782 from dims/update-kube-openapi
  • f6bb69f Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
  • ea180a6 Merge pull request #139821 from pohly/client-go-informers-type-safety
  • 118c85d Merge pull request #140693 from lalitc375/limit-subfields
  • 5779c75 Merge pull request #140732 from thockin/dv-add-prefixed-label-key
  • 5991a20 Add a DV format for prefixed label key
  • 7850673 code-generator/validation-gen: Disable nested +k8s:subfield validations
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the go-modules group across 1 directory with 9 updates
d573547 
Bumps the go-modules group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/argoproj/argo-cd/v3](https://github.com/argoproj/argo-cd) | `3.4.5` | `3.5.2` |
| [github.com/bitfield/script](https://github.com/bitfield/script) | `0.24.3` | `0.25.0` |
| [github.com/getsops/sops/v3](https://github.com/getsops/sops) | `3.13.2` | `3.13.3` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.54.0` | `0.55.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.57.0` | `0.58.0` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.2` | `0.37.0` |
| [k8s.io/code-generator](https://github.com/kubernetes/code-generator) | `0.36.2` | `0.37.0` |



Updates `github.com/argoproj/argo-cd/v3` from 3.4.5 to 3.5.2
- [Release notes](https://github.com/argoproj/argo-cd/releases)
- [Changelog](https://github.com/argoproj/argo-cd/blob/master/CHANGELOG.md)
- [Commits](argoproj/argo-cd@v3.4.5...v3.5.2)

Updates `github.com/bitfield/script` from 0.24.3 to 0.25.0
- [Commits](bitfield/script@v0.24.3...v0.25.0)

Updates `github.com/getsops/sops/v3` from 3.13.2 to 3.13.3
- [Release notes](https://github.com/getsops/sops/releases)
- [Changelog](https://github.com/getsops/sops/blob/main/CHANGELOG.md)
- [Commits](getsops/sops@v3.13.2...v3.13.3)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0
- [Commits](golang/crypto@v0.54.0...v0.55.0)

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
- [Commits](golang/net@v0.57.0...v0.58.0)

Updates `golang.org/x/text` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.40.0...v0.41.0)

Updates `k8s.io/apimachinery` from 0.36.2 to 0.37.0
- [Commits](kubernetes/apimachinery@v0.36.2...v0.37.0)

Updates `k8s.io/code-generator` from 0.36.2 to 0.37.0
- [Commits](kubernetes/code-generator@v0.36.2...v0.37.0)

---
updated-dependencies:
- dependency-name: github.com/argoproj/argo-cd/v3
  dependency-version: 3.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/bitfield/script
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/getsops/sops/v3
  dependency-version: 3.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: golang.org/x/text
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: k8s.io/code-generator
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 31, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 2, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-modules-2399e1fc23 branch September 2, 2026 15:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants