Skip to content

chore(deps): bump k8s.io/apimachinery from 0.36.4 to 0.37.0 in the kubernetes group - #6837

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/go_modules/kubernetes-cf41687a80
Closed

chore(deps): bump k8s.io/apimachinery from 0.36.4 to 0.37.0 in the kubernetes group#6837
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/go_modules/kubernetes-cf41687a80

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the kubernetes group with 1 update: k8s.io/apimachinery.

Updates k8s.io/apimachinery from 0.36.4 to 0.37.0

Commits
  • 7164e39 Update dependencies to v0.37.0 tag
  • e55f9ba feat(api): Update node restriction admission to use new API
  • cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis
  • 97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api
  • f21afab Add validation for camelcase in reason field
  • d7ad413 Merge pull request #140782 from dims/update-kube-openapi
  • e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist
  • 464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
  • 0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key
  • 95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the kubernetes group with 1 update: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery).


Updates `k8s.io/apimachinery` from 0.36.4 to 0.37.0
- [Commits](kubernetes/apimachinery@v0.36.4...v0.37.0)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: kubernetes
...

Signed-off-by: dependabot[bot] <support@github.com>
@ksail-bot
ksail-bot Bot enabled auto-merge (squash) September 2, 2026 17:15
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@devantler

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

Parked on #6728 — this cannot merge, and not for a reason anything in this PR can fix.

The build failure here is a partial bump inside the kubernetes group: k8s.io/apimachinery moved to 0.37.0 while k8s.io/api and k8s.io/apiserver stayed at 0.36.4. The compiler says so directly:

k8s.io/api@v0.36.4/extensions/v1beta1/zz_generated.validations.go:128:33: undefined: validate.EachSliceVal
k8s.io/apiserver@v0.36.4/pkg/registry/rest/validate.go:138:31:            undefined: validate.EachSliceVal

0.36.4's generated validations call into an apimachinery validate surface that 0.37.0 no longer provides in that shape, so the mixed set cannot compile.

Why only apimachinery moved. .github/dependabot.yaml groups k8s.io/* and sigs.k8s.io/*, but as that file's own talos comment records, grouping "batches whichever of these modules have an update available into ONE pull request. It does not enforce version equality and does not require every module to move, so a partial bump is still possible." The rest of the family is held at 0.36 by the constraint tracked in #6728loft-sh/apiserver has no k8s-0.37-compatible release (verified there 2026-09-01: proxy.golang.org still returns only the pinned v0.0.0-20260707184419-aef558a5ae8d, nothing published since 2026-07-07). So the group emits the one member that can move, and that member alone does not build.

Same cause as the sibling failures, which is why this is one blocker rather than three:

Artifact Failure Same cause?
this PR undefined: validate.EachSliceVal (api/apiserver at 0.36.4) yes
#6826 (talos group) k8s.io/cri-client@v0.36.1/pkg/remote_runtime.go:150 — the CheckpointPod skew #6728 names explicitly yes
daily go_modules in /. dependabot run k8s.io/client-go/kubernetes/scheme imports k8s.io/api/scheduling/v1alpha2: cannot find module providing package yes

One thing worth adding to the record: because the group does not enforce lockstep, it will keep producing unbuildable partial bumps for as long as #6728 is open. That is expected noise from a correct configuration, not a new defect each time — noting it here so the next run recognises the shape instead of re-diagnosing it.

No action taken on this PR. It stays open and parked; it becomes mergeable when #6728 clears, and closing it would only have Dependabot recreate it.

@devantler

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

The failure is reproducible at a10a2cce3ffd0544e7b3051ee07d78555d2daf93: go test ./... compiles k8s.io/api@v0.36.4 and k8s.io/apiserver@v0.36.4 against k8s.io/apimachinery@v0.37.0, then fails on removed validate.EachSliceVal and changed validation option types.

This cannot be repaired by widening this PR mechanically. A coordinated 1.37/0.37 experiment removes the immediate skew but exposes further compatibility work in KSail's test doubles and github.com/loft-sh/apiserver. #6841 records the root cause, and draft #6842 keeps patch and security updates automated while preventing Dependabot from opening partial Kubernetes minor-line updates.

@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like k8s.io/apimachinery is no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 2, 2026
auto-merge was automatically disabled September 2, 2026 19:25

Pull request was closed

@github-project-automation github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Sep 2, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/kubernetes-cf41687a80 branch September 2, 2026 19:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

1 participant