chore(deps): bump Go to 1.26.3 and upgrade all dependencies to latest#4483
Merged
ValClarkson merged 1 commit intoMay 13, 2026
Merged
Conversation
…OTel Now that the x/net CVE fix (CrunchyData#4481) and the k8s 0.36.0 / controller-runtime 0.24.0 jump (CrunchyData#4479) are on main, this finishes the planned upgrade pass with patch bumps and the Go toolchain bump: * Go 1.26.0 -> 1.26.3 (go directive only; e2e CI still installs Go 1.25.x for kuttl/chainsaw which depend on testDeps.ModulePath at the older toolchain). * k8s.io/api, apimachinery, client-go 0.36.0 -> 0.36.1 * sigs.k8s.io/controller-runtime 0.24.0 -> 0.24.1 * go.opentelemetry.io/otel{,/sdk,/trace,/metric,/log,/sdk/log,/sdk/metric} 1.42.0 -> 1.43.0 (and matching otlp/* exporters; stdout* and log* sub- modules to v0.19.0 / v1.43.0 / v0.65.0 as appropriate). * go.opentelemetry.io/contrib/{exporters/autoexport,instrumentation/net/http/ otelhttp,propagators/autoprop,bridges/prometheus,propagators/{aws,b3, jaeger,ot}} 0.67.0/1.42.0 -> 0.68.0/1.43.0. These are all patch / minor bumps within their respective stable lines. 'go mod tidy', 'go build ./...', 'go vet ./...', 'make generate', and 'golangci-lint run' all pass cleanly with no source changes required. Supersedes the Dependabot PRs CrunchyData#4475, CrunchyData#4477, CrunchyData#4478 and the older snapshot of CrunchyData#4483. Signed-off-by: ValClarkson <valerie.clarkson@crunchydata.com>
ValClarkson
force-pushed
the
chore/bump-go-1.26.3-and-deps
branch
from
15c00da to
828e909
Compare
andrewlecuyer
approved these changes
May 13, 2026
ValClarkson
added a commit
to ValClarkson/postgres-operator
that referenced
this pull request
May 14, 2026
….24.1, Go to 1.26.3 Brings REL_5_8 in line with the dependency baseline already running on main (PRs CrunchyData#4479 and CrunchyData#4483) so that the branch picks up: - k8s.io/* 0.35.2 -> 0.36.1 - k8s.io/apiextensions-apiserver / apiserver 0.35.0 -> 0.36.0 - k8s.io/kube-openapi refreshed to the v0.36.1 timestamp - k8s.io/klog/v2 2.130.1 -> 2.140.0 - k8s.io/utils refreshed - sigs.k8s.io/controller-runtime 0.23.1 -> 0.24.1 - sigs.k8s.io/apiserver-network-proxy/konnectivity-client 0.31.2 -> 0.34.0 - sigs.k8s.io/structured-merge-diff/v6 to a stable v6.3.2 - go directive 1.25.0 -> 1.26.3 (matches main) - golang.org/x/time 0.9.0 -> 0.14.0 - google.golang.org/grpc 1.79.1 -> 1.79.3 - google.golang.org/protobuf 1.36.11 -> 1.36.12 pre-release This supersedes Dependabot PR CrunchyData#4476: that PR mixes k8s 0.36.0 with controller-runtime 0.23.3, which fails to compile because client-go v0.36 added a HasSyncedChecker method to ResourceEventHandlerRegistration that controller-runtime 0.23.x does not implement. Bumping cr to 0.24.1 is the supported combination. Required source / config backports (mirror PR CrunchyData#4483 on main): - config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml: `make generate-crd` strips the now-obsolete "ProcMountType feature flag" sentence from the procMount field description, since the gate was promoted to GA in Kubernetes 1.36. - internal/controller/postgrescluster/volumes.go: handle the new `corev1.PersistentVolumeClaimUnused` condition (KEP-4901, K8s 1.36) in the existing no-op `case` so that the `exhaustive` linter is satisfied. - internal/controller/postgrescluster/pgbackrest.go: fix a `go vet` warning that surfaced under Go 1.26 by adding a %q verb to the `EventRecorder.Eventf` call that was passing `repoName` without a matching format directive. - .golangci.yaml: add SA1019 exclusions for two new deprecations: * `managed.FieldsV1.Raw` (k8s.io/apimachinery v0.36 deprecated direct field access; tests still exercise the legacy field). * `scheme.Builder` (controller-runtime v0.24 deprecated; the recommended replacement requires restructuring our api packages and is left for a follow-up). `generate-rbac` is unchanged from REL_5_8 and was not regenerated here because controller-gen tries to parse `internal/postgres/...`, which transitively imports `pg_query_go` and fails to build on macOS hosts (unrelated to this bump). Co-authored-by: Cursor <cursoragent@cursor.com>
ValClarkson
added a commit
to ValClarkson/postgres-operator
that referenced
this pull request
May 14, 2026
….24.1, Go to 1.26.3 Brings REL_5_8 in line with the dependency baseline already running on main (PRs CrunchyData#4479 and CrunchyData#4483) so that the branch picks up: - k8s.io/* 0.35.2 -> 0.36.1 - k8s.io/apiextensions-apiserver / apiserver 0.35.0 -> 0.36.0 - k8s.io/kube-openapi refreshed to the v0.36.1 timestamp - k8s.io/klog/v2 2.130.1 -> 2.140.0 - k8s.io/utils refreshed - sigs.k8s.io/controller-runtime 0.23.1 -> 0.24.1 - sigs.k8s.io/apiserver-network-proxy/konnectivity-client 0.31.2 -> 0.34.0 - sigs.k8s.io/structured-merge-diff/v6 to a stable v6.3.2 - go directive 1.25.0 -> 1.26.3 (matches main) - golang.org/x/time 0.9.0 -> 0.14.0 - google.golang.org/protobuf 1.36.11 -> 1.36.12 pre-release This supersedes Dependabot PR CrunchyData#4476: that PR mixes k8s 0.36.0 with controller-runtime 0.23.3, which fails to compile because client-go v0.36 added a HasSyncedChecker method to ResourceEventHandlerRegistration that controller-runtime 0.23.x does not implement. Bumping cr to 0.24.1 is the supported combination. Required source / config backports (mirror PR CrunchyData#4483 on main): - config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml: `make generate-crd` strips the now-obsolete "ProcMountType feature flag" sentence from the procMount field description, since the gate was promoted to GA in Kubernetes 1.36. - internal/controller/postgrescluster/volumes.go: handle the new `corev1.PersistentVolumeClaimUnused` condition (KEP-4901, K8s 1.36) in the existing no-op `case` so that the `exhaustive` linter is satisfied. - internal/controller/postgrescluster/pgbackrest.go: fix a `go vet` warning that surfaced under Go 1.26 by adding a %q verb to the `EventRecorder.Eventf` call that was passing `repoName` without a matching format directive. - .golangci.yaml: add SA1019 exclusions for two new deprecations: * `managed.FieldsV1.Raw` (k8s.io/apimachinery v0.36 deprecated direct field access; tests still exercise the legacy field). * `scheme.Builder` (controller-runtime v0.24 deprecated; the recommended replacement requires restructuring our api packages and is left for a follow-up). `generate-rbac` is unchanged from REL_5_8 and was not regenerated here because controller-gen tries to parse `internal/postgres/...`, which transitively imports `pg_query_go` and fails to build on macOS hosts (unrelated to this bump). Co-authored-by: Cursor <cursoragent@cursor.com>
ValClarkson
added a commit
that referenced
this pull request
May 14, 2026
….24.1, Go to 1.26.3 Brings REL_5_8 in line with the dependency baseline already running on main (PRs #4479 and #4483) so that the branch picks up: - k8s.io/* 0.35.2 -> 0.36.1 - k8s.io/apiextensions-apiserver / apiserver 0.35.0 -> 0.36.0 - k8s.io/kube-openapi refreshed to the v0.36.1 timestamp - k8s.io/klog/v2 2.130.1 -> 2.140.0 - k8s.io/utils refreshed - sigs.k8s.io/controller-runtime 0.23.1 -> 0.24.1 - sigs.k8s.io/apiserver-network-proxy/konnectivity-client 0.31.2 -> 0.34.0 - sigs.k8s.io/structured-merge-diff/v6 to a stable v6.3.2 - go directive 1.25.0 -> 1.26.3 (matches main) - golang.org/x/time 0.9.0 -> 0.14.0 - google.golang.org/protobuf 1.36.11 -> 1.36.12 pre-release This supersedes Dependabot PR #4476: that PR mixes k8s 0.36.0 with controller-runtime 0.23.3, which fails to compile because client-go v0.36 added a HasSyncedChecker method to ResourceEventHandlerRegistration that controller-runtime 0.23.x does not implement. Bumping cr to 0.24.1 is the supported combination. Required source / config backports (mirror PR #4483 on main): - config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml: `make generate-crd` strips the now-obsolete "ProcMountType feature flag" sentence from the procMount field description, since the gate was promoted to GA in Kubernetes 1.36. - internal/controller/postgrescluster/volumes.go: handle the new `corev1.PersistentVolumeClaimUnused` condition (KEP-4901, K8s 1.36) in the existing no-op `case` so that the `exhaustive` linter is satisfied. - internal/controller/postgrescluster/pgbackrest.go: fix a `go vet` warning that surfaced under Go 1.26 by adding a %q verb to the `EventRecorder.Eventf` call that was passing `repoName` without a matching format directive. - .golangci.yaml: add SA1019 exclusions for two new deprecations: * `managed.FieldsV1.Raw` (k8s.io/apimachinery v0.36 deprecated direct field access; tests still exercise the legacy field). * `scheme.Builder` (controller-runtime v0.24 deprecated; the recommended replacement requires restructuring our api packages and is left for a follow-up). `generate-rbac` is unchanged from REL_5_8 and was not regenerated here because controller-gen tries to parse `internal/postgres/...`, which transitively imports `pg_query_go` and fails to build on macOS hosts (unrelated to this bump). Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Now that the x/net CVE fix (#4481) and the k8s 0.36.0 / controller-runtime
0.24.0 jump (#4479) are on main, this finishes the planned upgrade pass with
patch bumps and the Go toolchain bump:
for kuttl/chainsaw which depend on testDeps.ModulePath at the older
toolchain).
1.42.0 -> 1.43.0 (and matching otlp/* exporters; stdout* and log* sub-
modules to v0.19.0 / v1.43.0 / v0.65.0 as appropriate).
otelhttp,propagators/autoprop,bridges/prometheus,propagators/{aws,b3,
jaeger,ot}} 0.67.0/1.42.0 -> 0.68.0/1.43.0.
These are all patch / minor bumps within their respective stable lines.
'go mod tidy', 'go build ./...', 'go vet ./...', 'make generate', and
'golangci-lint run' all pass cleanly with no source changes required.
Supersedes the Dependabot PRs Bump the go-dependencies group across 1 directory with 5 updates #4475, Bump the kubernetes group across 1 directory with 7 updates #4477, Bump the opentelemetry group across 1 directory with 6 updates #4478 and the older snapshot
of chore(deps): bump Go to 1.26.3 and upgrade all dependencies to latest #4483.