[sbaum1994]

TL;DR

Select proposed collector maintenance patch 0.160.0-nv-0.2.9 for the compute-plane 1.0 stack. The current 0.160.0-nv-0.2.8 collector images retain golang.org/x/net v0.58.0; the producer patch updates the effective dependency to v0.60.0 while retaining the collector 0.160.0 / wrapper 0.2 feature set.

Additional Details

Both BYOO function/task overrides and the ordinary collector select the same maintenance patch. Refresh the two affected golden manifests from the pinned operator chart. Existing collector inventory discovery from #2872 already covers both image forms, so its configuration and extraction code need no change. Main retains the newer, already patched 0.160.0-nv-0.4.7 train.

For the Reviewer

This is reviewable source for a future image version. Merge only after the producer patch is merged, an independently authorized ordinary release is published, and both collector images at 0.160.0-nv-0.2.9 have verified platform digests and qualification. If another patch occupies that version first, update these pins and regenerate the fixtures before merging. The latest observed maintenance tag is 0.160.0-nv-0.2.8; 0.2.9 has no source tag at preparation time and is not claimed available or reserved. Maintenance collector tags require a separate explicit release action under current automation.

The compute-plane stack release and its inventory follow the consumer merge. Stack resource and umbrella customer publication remain held for another QA round. Published tags and images are unchanged. Runtime topology, diagrams, enablement defaults, other component versions, and documentation release facts are unchanged.

Dependencies: the two existing NVIDIA collector images move together. Their producer updates existing BSD-3-Clause Go dependencies; license texts are unchanged. This consumer adds no third-party package, attribution file, or NOTICE change.

For QA

Passed collector image routing, default ownership, and observability profile tests against the immutable operator chart, including mirrored repositories, explicit overrides, and both function/task BYOO inputs. All operator render files match the refreshed golden fixtures. Existing tests cover this pin-only change; no new test is needed.

Passed go test and go vet for tools/docs-version-sync, documentation sync, generated-document consistency and Fern checks. Producer runtime qualification is in progress. These render checks do not establish published image availability or full cluster qualification. Exact-digest qualification and the next combined stack QA round remain required before publication.

Issues

Relates to #2797

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sbaum1994]

Superseded by #2871, which combines the tested collector maintenance pins with the Samba maintenance pins and has passed the combined consumer checks. Collector producer #2877 remains separate, and the shared consumer PR retains the merge-after-producer-publication and qualification prerequisites. The collector-only branch and commit are preserved.