Skip to content

chore(deps): update all non-major dependencies - #417

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#417
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
argo-cd patch 10.8.0 → 10.8.2
grafana (source) patch 13.2.1 → 13.2.2
holmes minor 0.40.0 → 0.41.0
kubernetes-sigs/gateway-api minor v1.1.0 → v1.6.2

Release Notes

argoproj/argo-helm (argo-cd)

v10.8.2

Compare Source

v10.8.1

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

Full Changelog: argoproj/argo-helm@argo-events-2.4.26...argo-cd-10.8.1

grafana-community/helm-charts (grafana)

v13.2.2

Compare Source

Helm chart for Grafana Loki supporting monolithic, simple scalable, and microservices modes.

What's Changed

New Contributors

Full Changelog: grafana-community/helm-charts@loki-13.2.1...loki-13.2.2

kubernetes-sigs/gateway-api (kubernetes-sigs/gateway-api)

v1.6.2

Compare Source

v1.6.2

Major Changes Since v1.6.1

Bug or Regression
  • HTTPRequestRedirectFilter status codes 303, 307, and 308 are Extended conformance, not Core. (#​5173, @​kflynn)
Other (Cleanup or Flake)
  • Fix flaky TCPRouteWeightedRouting and UDPRouteWeightedRouting conformance tests by adding a data-plane readiness check before performing weighted routing assertions. (#​5064, @​arybolovlev)
  • Fix FailFast not working as expected (#​5204, @​zirain)
  • Allow disabling parallel tests at the suite level (#​5184, @​zirain)

v1.6.1

Compare Source

v1.6.1

Major Changes Since v1.6.0

Test & Conformance
  • Change the port used in TCPRouteMultipleRoutesAttachment. (#​5053, @​davidjumani)
  • Respect CleanupTestResources for BackendTLSPolicy, TCPRouteMultipleRoutesAttachment and UDPRouteMultipleRoutesAttachment(#​5065, @​snorwin)
  • Fix SetupTimeoutConfig() not respecting defaults for ListenerSetMustHaveCondition, ListenerSetListenersMustHaveConditions, and RequiredConsecutiveSuccesses. (#​5066, @​immanuwell)
  • Honour tcpRouteMustHaveCondition and udpRouteMustHaveCondition timeouts which were silently ignore. (#​5067, @​immanuwell)
Other (Cleanup or Flake)
  • Fix GatewayStaticAddresses test flake by waiting for status.addresses to be published instead of assuming it appears atomically with Programmed. (#​5038, @​howardjohn)
  • Fix GatewayInfrastructure test flake by polling for generated infrastructure resources instead of assuming immediate visibility after the gateway is accepted. (#​5047, @​howardjohn)
  • Fix flaky TCPRouteWeightedRouting and UDPRouteWeightedRouting conformance tests by adding a data-plane readiness check before performing weighted routing assertions. (#​5064, @​arybolovlev)

v1.6.0

Compare Source

v1.6.0

Changes Since v1.5.1

GEP & API Graduation
  • UDPRoute & TCPRoute Graduation:
    • UDPRoute has graduated to GA. We recommend using the "v1" API version with this API now. The "v1alpha2" version of this API is deprecated and will be removed in the future. (#​4923, @​zac-nixon)
    • TCPRoute has graduated to GA. We recommend using the "v1" API version with this API now. The "v1alpha2" version of this API is deprecated and will be removed in the future. (#​4920, @​zac-nixon)
  • GEP Status Updates:
Feature
  • API & Validation Enhancements:
    • API validation updated for HTTPRoute retries: retry.codes must now be unique and retry.attempts must be >= 1. (#​4907, @​snorwin)
    • Increase the number of allowed Certificate Authority references from 8 to 16. (#​4088, @​root30)
    • The TLSRoute CRD validation has been adjusted to allow up to 1024 hostnames and rules per TLSRoute resource. Operators must validate kube-apiserver, etcd and Gateway controller behavior with representative manifests prior to enabling the new limit in production. (#​4332, @​alexanderstephan)
    • BackendTLSPolicy now can be used in combination with other routes types. (#​4745, @​rikatz)
    • Allow the usage of up to 16 annotations on the gateway infrastructure object. (#​4707, @​wenisman)
  • Conformance Infrastructure:
    • Added conformance tests for UDPRoute (GEP-2645), a new GATEWAY-UDP conformance profile, a SupportTCPRoute feature, and a UDP/TCP echo server in echo-basic gated on UDP_ECHO_SERVER. (#​4861, @​zac-nixon)
  • Remove the idleTimeout field from the experimental SessionPersistence API. (#​4771, @​gcs278)
Documentation
Bug or Regression
  • IPv6 Support:
    • Fix GatewayFrontendClientCertificateValidationInsecureFallback, GatewayFrontendClientCertificateValidation, and GatewayFrontendInvalidDefaultClientCertificateValidation failing on IPv6 clusters. (#​4636, @​zirain)
    • Fix GatewayFrontendInvalidDefaultClientCertificateValidation failing on IPv6 clusters. (#​4629, @​zirain)
  • ValidatingAdmissionPolicy (VAP) Fixes:
    • Fixed an issue where the ValidatingAdmissionPolicy prevented experimental CRDs from being installed at all (instead of only when standard CRDs already exist). (#​4603, @​howardjohn)
    • Fixed the safe-upgrades ValidatingAdmissionPolicy to allow upgrades of experimental CRDs. (#​4557, @​snorwin)
  • CRD & Schema Validation:
    • Generated Gateway API CRD install manifests no longer include top-level CustomResourceDefinition status fields with invalid null values, fixing strict schema validation failures in tools such as kubeconform. (#​4712, @​MatteoFari)
    • Replace omitempty with omitzero for supportedKinds in ListenerStatus to preserve backward compatibility for controllers reconciling older Gateway API versions. (#​4551, @​snorwin)
  • API & Validation Fixes:
Test & Conformance
  • New Conformance Tests:
    • Add conformance test ListenerSetAllowedRoutesCrossNamespace which verifies that a ListenerSet only allows routes in its own namespace by default. (#​4841, @​asauber)
    • Added a conformance test covering the Gateway Accepted condition with reason ListenersNotValid and the Listener Accepted condition with reason UnsupportedProtocol. (#​4807, @​snorwin)
    • Added conformance test GatewayInvalidParametersRef that verifies a Gateway referencing an invalid parameters is rejected. (#​4808, @​snorwin)
    • Conformance: add ListenerSet tests for Route parentRef cases. (#​4912, @​asauber)
  • Test Machinery & Framework Updates:
    • Conformance: ExpectMirroredRequest now starts its log window before the requests are sent, so mirrors are not missed on high-latency data planes. (#​4952, @​lexfrei)
    • The default polling interval for conformance tests has been decreased. This can be modified by the new DefaultPollInterval. (#​4570, @​howardjohn)
    • The gRPC conformance request helper no longer closes a caller-supplied (injected) Options.GRPCClient; it closes only the DefaultClient it creates internally. This lets implementations reuse a custom gRPC client across requests. (#​4953, @​lexfrei)
  • Updates & Fixes to Existing Tests:
    • The conflicted=false condition is not required anymore in the listener status for non-conflicted listeners. (#​4642, @​zhaohuabing)
    • Fix TLSRoute conformance test to stop relying on self-signed certificates. (#​4930, @​rikatz)
    • Fixed MeshHTTPRoute307Redirect conformance test bug where the wrong manifest was used. (#​4806, @​jgreeer)
    • Update Gateway version to v1 in UDP conformance test. (#​4722, @​cnvergence)
    • Updated the TLSRoute conformance tests to allow FINs where previously RST was asserted. (#​4615, @​howardjohn)
    • conformance: add missing gateway-api/skip-this-for-readiness annotation to invalid gateways (#​5027, @​snorwin)
    • The GRPCRouteWeight conformance test now sends its distribution-sampling requests through the injectable Options.GRPCClient instead of a hardcoded DefaultClient, allowing implementations that supply a custom gRPC client to run it. (#​5004, @​lexfrei)
    • The HTTPRouteRequestPercentageMirror conformance test now derives its acceptance band from the binomial standard deviation instead of a flat ±15% relative tolerance, removing sampling-variance flakes at low mirror percentages. (#​5005, @​lexfrei)
    • Removed HTTPRoute retry tests with connection errors and backend timeouts (#​4994, @​snorwin)

What's Changed

New Contributors

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 8am on saturday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from jdwillmsen as a code owner September 5, 2026 00:49
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Sep 5, 2026
@renovate
renovate Bot requested a review from jdwlabs-root as a code owner September 5, 2026 00:49
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Sep 5, 2026
@renovate

renovate Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: cli/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af -> v1.36.12

@jdwillmsen

jdwillmsen commented Sep 5, 2026

Copy link
Copy Markdown
Member

Review 2026-09-05 (agent-run, recorded for the codeowner who has to approve this: every gated path here, /cli/, /tenants/platform/, /tools/, needs a real codeowner review, admin bypass does not clear it).

Unblocked: the failing image-pin-check / orphaned-manifest-check were one cause: the curlimages/curl bump dropped out of the tag-keyed allowlist. Pinned it by manifest-list digest (8.22.0@sha256:58adaa4e…, verified against both docker manifest inspect and the registry Docker-Content-Digest header) and removed the stale allowlist entry. All 19 checks green.

Before merging, two bumps need a human decision:

  1. nginx-gateway-fabric 2.6.7 to 2.7.0. Upstream's upgrade note: Gateway API moved to 1.6.1 and TCPRoute/UDPRoute were promoted to standard v1; the release says to install that Gateway API version before upgrading NGF. This repo vendors Gateway API CRDs in bootstrap/crds/foundation-crds.yaml at bundle v1.1.0 (experimental channel), and the vendored TCPRoute/UDPRoute CRDs serve only v1alpha2. No TCPRoute/UDPRoute objects exist in-repo, so the practical risk is whether the 2.7.0 controller's informer cache tolerates the missing v1 version at startup. nginx-gateway is sync wave 1 core ingress. Recommendation: either bump the vendored Gateway API CRDs in the same change and add a freshness check like the monitoring one, or hold NGF back to 2.6.x in this batch.
  2. argo-cd chart 10.4.1 to 10.8.0 adds a default application-controller livenessProbe where there was none. tenants/platform/services/argo-cd/values.yaml records the controller being OOM-killed during mass-merge sync storms and raised memory to compensate; a new probe with default thresholds can restart the controller mid-storm instead of letting it run hot. Check the chart's default thresholds or set controller.livenessProbe explicitly.

Lower-risk notes: truenas-csi v1.2.0 to v1.3.0 has no release notes attached (storage driver, worth a glance upstream); the grafana chart notes in the body describe the co-versioned Loki chart (known Renovate quirk), so they prove nothing about grafana 13.0.1 to 13.2.1; kube-prometheus-stack 88.6.1 to 88.6.5 is additive and the vendored monitoring CRDs already pass freshness.

@jdwlabs-agent-bot jdwlabs-agent-bot Bot mentioned this pull request Sep 8, 2026
Merged
jdwillmsen
jdwillmsen previously approved these changes Sep 8, 2026
View reviewed changes
@jdwillmsen jdwillmsen mentioned this pull request Sep 8, 2026
Merged
@jdwillmsen

jdwillmsen commented Sep 8, 2026

Copy link
Copy Markdown
Member

Decision brief on the two parked entries

Investigated both against the live cluster and the charts' own source. Both parked premises turn out to be wrong or inverted, and both upgrades are safe to take. Opening them as two separate PRs rather than unparking them here, so a failure stays attributable.

argo-cd 10.4.1 → 10.8.0 — the new controller livenessProbe is off by default

The chart ships it disabled, with its own comment citing the upstream reason:

livenessProbe:
  enabled: false   # Argo CD removed this probe deliberately because
                   # restarting an overloaded controller usually makes things worse

The StatefulSet template wraps it in {{- if .Values.controller.livenessProbe.enabled }}, so the OOM-during-sync-storm concern recorded in tenants/platform/services/argo-cd/values.yaml is never exposed. Nothing to configure — and explicitly don't pin controller.livenessProbe, that would freeze a value we'd then have to maintain.

helm template on both versions against this repo's values, normalising the helm.sh/chart string, is 24 changed lines total:

  • appVersion unchanged, v3.5.2 → v3.5.2 — no binary change, no CRD change, no migration
  • checksum/cm + checksum/cmd-params annotation values change on the controller STS and the server/repo-server/dex/applicationset Deployments, because the chart's checksum helper now hashes only data/stringData instead of the whole manifest. ConfigMap contents are byte-identical
  • optional: true on the argocd-tls-certs-cm volume (the CM exists, 0 keys)
  • dnsPolicy: ClusterFirst on the redis-secret-init Job — equals the defaulted live value

Everything else in the values diff is additive and unused here (VPA startup boost, redis-ha sentinel hook, redis hostNetwork, redis-exporter tag). redis.image.tag is 8.6.4-alpine in both.

Self-management, since ArgoCD applies itself: the pods will restart, but from the helm.sh/chart pod-template label, not the annotations — the tenant appset's ignoreDifferences covers .spec.template.metadata.annotations and not .labels. Same thing happened on the previous chart bump (all argocd pods restarted together 2026-08-29T04:52, RESTARTS: 0 since). Because appVersion is identical, the controller that comes back is the same binary; worst case is a sync left Running that needs a manual re-sync.

nginx-gateway-fabric 2.6.7 → 2.7.0 — the CRD gap is real, but this cluster is already in that state and it does not fail

The cluster runs Gateway API bundle v1.1.0, experimental channel (bootstrap/crds/foundation-crds.yaml, owned by the platform-crds Application at sync-wave -1) against NGF 2.6.7's recommended v1.5.1. The GatewayClass already says so today:

SupportedVersion=False  reason=UnsupportedVersion
  msg=The Gateway API CRD versions are not recommended. Recommended version is v1.5.1
Accepted=True  ResolvedRefs=True

NGF's validateCRDVersions compares major only, then flags a minor mismatch as bestEffort rather than unsupported. v1.1.0 against v1.6.1 lands in the same bucket as v1.1.0 against v1.5.1. So 2.7.0 changes that condition's message string and nothing else; Gateways stay Accepted and Programmed.

On TCPRoute/UDPRoute specifically: 2.7.0 moved them out of the experimental-features block and gated them on the v1 CRD being served. Live discovery has them only at v1alpha2:

/apis/gateway.networking.k8s.io/v1      → GRPCRoute, Gateway, GatewayClass, HTTPRoute
/apis/gateway.networking.k8s.io/v1alpha2 → GRPCRoute, ReferenceGrant, TCPRoute, TLSRoute, UDPRoute

Kind absent at v1 → the controller is filtered out of registration and its ObjectList never enters the cache. No informer, no error, no crash. And nothing is lost: the deployment carries no --gateway-api-experimental-features flag, so those routes aren't watched today either, and kubectl get tcproutes,udproutes,tlsroutes -A returns nothing (24 HTTPRoutes, 0 GRPCRoutes). ReferenceGrant falls back to gatewayv1beta1.ReferenceGrantList identically in both versions, so the per-namespace allow-gateway-tls grants are unaffected.

Rendered chart delta: images to 2.7.0, two new controller args that equal current implicit defaults (--server-tls-domain=svc, --cluster-domain=cluster.local), new RBAC (services/status patch, PDBs, tcproutes/udproutes), a metrics port on the control-plane Service, the cert-generator hook resources gaining pre-upgrade, and 2 new additive CRDs (externalloadbalancers, payloadprocessors). skipCrds isn't set in the tenant envelope, so those land automatically — no manual CRD step. kubeVersion floor moves to >=1.32.0-0; cluster is v1.36.3.

The actual cost is traffic, not CRDs. The data-plane DaemonSet is created by the controller, not Helm, and will roll all 5 pods at maxSurge: 0, maxUnavailable: 1 behind a NodePort Service with externalTrafficPolicy: Local — each node's 30180/30543 refuses connections while its pod restarts. Whatever fronts those NodePorts has to health-check the draining node out. There's also a brief control-plane-2.7.0 / data-plane-2.6.7 skew window.

Deliberately not bundled

Gateway API v1.1.0 → v1.6.1 is a five-minor jump that changes served/storage versions on referencegrants (currently v1beta1 storage) and needs its own storage-version-migration plan. It is not a prerequisite for NGF 2.7.0 — the SupportedVersion=False condition predates this upgrade and simply continues.

Rollback

Both are a one-line revert of tenants/platform/tenant.yaml plus an ArgoCD sync. NGF: prune: true removes the two new CRDs, no CRs of those kinds exist; if the control plane is wedged, kubectl -n nginx-gateway rollout undo deploy/platform-nginx-gateway-fabric restores 2.6.7 out-of-band while the existing DaemonSet keeps serving. argo-cd: symmetric, since appVersion is unchanged in both directions; escape hatch is kubectl -n argocd rollout undo statefulset/argocd-application-controller.

Not verified

Two things inferred rather than executed: that ArgoCD deletes the cert-generator hook RBAC at PreSync-phase completion rather than immediately (worth eyeballing on the first NGF sync — if it were immediate, the Job could lose its RBAC mid-run), and that a controller restart mid-sync leaves a Running operation rather than a stuck app.

🤖 Generated with Claude Code

This was referenced Sep 8, 2026
Merged
Merged
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from d236495 to 7747c6c Compare September 9, 2026 03:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jdwillmsen jdwillmsen jdwillmsen left review comments
@jdwlabs-root jdwlabs-root Awaiting requested review from jdwlabs-root jdwlabs-root is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jdwillmsen