Skip to content

build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.32.0 to 4.33.0 in /deploy - #1449

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/deploy/github.com/pulumi/pulumi-kubernetes/sdk/v4-4.33.0
Closed

build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.32.0 to 4.33.0 in /deploy#1449
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/deploy/github.com/pulumi/pulumi-kubernetes/sdk/v4-4.33.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.32.0 to 4.33.0.

Release notes

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

v4.33.0

4.33.0 (July 7, 2026)

Added

  • #3595 Add takeOwnership to kubernetes.helm.sh/v3:Release. When set, Helm skips the resource-conflict check and adopts existing resources into the release (equivalent to helm upgrade/helm install --take-ownership).
  • #3284 Add includeHooks to kubernetes.helm.sh/v4:Chart. When set together with the provider's renderYamlToDirectory, Helm hook resources (annotated helm.sh/hook) are included in the rendered output instead of being dropped, so that another tool (e.g. Argo CD) can apply them.

Changed

  • Upgrade Kubernetes schema and libraries to v1.36.2.
  • #4454 Document that skipAwait defaults to false on yaml/v2.ConfigFile, yaml/v2.ConfigGroup, and kustomize/v2.Directory.
Changelog

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

4.33.0 (July 7, 2026)

Added

  • #3595 Add takeOwnership to kubernetes.helm.sh/v3:Release. When set, Helm skips the resource-conflict check and adopts existing resources into the release (equivalent to helm upgrade/helm install --take-ownership).
  • #3284 Add includeHooks to kubernetes.helm.sh/v4:Chart. When set together with the provider's renderYamlToDirectory, Helm hook resources (annotated helm.sh/hook) are included in the rendered output instead of being dropped, so that another tool (e.g. Argo CD) can apply them. Test hooks (helm.sh/hook: test) are excluded, and the flag has no effect outside of render mode. This only brings render mode up to par with helm template; it does not implement full Helm hook lifecycle support (ordering, weights, delete policies, execution), so #3284 remains open.

Changed

  • Upgrade Kubernetes schema and libraries to v1.36.2.
  • #4454 Document that skipAwait defaults to false on yaml/v2.ConfigFile, yaml/v2.ConfigGroup, and kustomize/v2.Directory.
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 15, 2026
@rdimitrov

rdimitrov commented Jul 27, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/deploy/github.com/pulumi/pulumi-kubernetes/sdk/v4-4.33.0 branch from b7a36c5 to 858e06d Compare July 27, 2026 09:55
@rdimitrov rdimitrov mentioned this pull request Jul 27, 2026
Merged
rdimitrov added a commit that referenced this pull request Jul 27, 2026
@rdimitrov @claude
fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) (#1481)
8d35175 
## Problem

The **Build, Lint, and Validate** CI job is failing on every open PR
(#1480, #1474, #1449) and on `main`. The failing step is `govulncheck`:

```
Vulnerability #1: GO-2026-5970
    Infinite loop on invalid input in golang.org/x/text
    Found in: golang.org/x/text@v0.38.0
    Fixed in: golang.org/x/text@v0.39.0
```

This is **not** caused by any of those PRs' changes —
`govulncheck-action` fetches the live vulnerability database at runtime,
so when GO-2026-5970 was published, every branch based on the current
`main` started failing. The vulnerable symbol is reachable via:

- `auth.DefaultHTTPKeyFetcher.FetchKey` → `http.Client.Do`
- `database.NewTestDB` → `pgx.Connect`

so the scan exits with code 3.

## Fix

Bump the (indirect) `golang.org/x/text` dependency from `v0.38.0` to the
fixed `v0.39.0` and `go mod tidy`.

## Verification

- `govulncheck ./...` no longer reports GO-2026-5970 (confirmed
locally).
- `go build ./...` passes.

## Note

The `deploy/` module pins `golang.org/x/text@v0.37.0`, which is also <
v0.39.0. It is a separate module and is **not** scanned by this CI job
(govulncheck runs `./...` in the root module only), so it does not block
CI. Worth a follow-up bump for hygiene, but out of scope here.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@dependabot
build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 in /deploy
22bdd59 
Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.32.0 to 4.33.0.
- [Release notes](https://github.com/pulumi/pulumi-kubernetes/releases)
- [Changelog](https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md)
- [Commits](pulumi/pulumi-kubernetes@v4.32.0...v4.33.0)

---
updated-dependencies:
- dependency-name: github.com/pulumi/pulumi-kubernetes/sdk/v4
  dependency-version: 4.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/deploy/github.com/pulumi/pulumi-kubernetes/sdk/v4-4.33.0 branch from 858e06d to 22bdd59 Compare July 27, 2026 10:05
@rdimitrov rdimitrov mentioned this pull request Jul 27, 2026
Merged
rdimitrov added a commit that referenced this pull request Jul 27, 2026
@rdimitrov @claude
build(deps): consolidate open dependabot updates (#1482)
0b5cc0f 
Consolidates the five open dependabot PRs into a single change so they
can be reviewed and merged together. Each bump was reproduced against
current `main` (`go get` + `go mod tidy` for Go modules; the exact SHA
pins applied for the actions group), rather than merging the individual
branches, to avoid stale `go.sum` conflicts.

## Root module (`go.mod`)
| Dependency | From | To | Supersedes |
|---|---|---|---|
| `google.golang.org/grpc` | 1.82.0 | 1.82.1 | #1479 |
| `github.com/prometheus/client_golang` | 1.23.2 | 1.24.1 | #1475 |
| `github.com/danielgtaylor/huma/v2` | 2.38.0 | 2.39.0 | #1474 |

## Deploy module (`deploy/go.mod`)
| Dependency | From | To | Supersedes |
|---|---|---|---|
| `github.com/pulumi/pulumi-kubernetes/sdk/v4` | 4.32.0 | 4.33.0 | #1449
|

## GitHub Actions (#1476)
- `actions/setup-go` SHA bumped across `ci.yml`, `release.yml`,
`deploy-production.yml`, `deploy-staging.yml`
- `actions/download-artifact` v4 → v8.0.1 in
`close-invalid-publish-prs.yml`

`go mod tidy` re-resolved transitive dependencies in both modules
accordingly.

## Verification
- `go build ./...` passes (root + deploy)
- `go vet ./...` passes
- `govulncheck ./...` reports no `golang.org/x/text` finding (the
GO-2026-5970 fix from #1481 is preserved; tidy pulled x/text to v0.40.0)

## Follow-up
Once this merges, the five superseded PRs (#1479, #1475, #1474, #1449,
#1476) can be closed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@rdimitrov

rdimitrov commented Jul 27, 2026

Copy link
Copy Markdown
Member

Superseded by #1482, which consolidated the open dependabot updates and has now been merged. Closing this one as its bump is already on main.

@rdimitrov rdimitrov closed this Jul 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/go_modules/deploy/github.com/pulumi/pulumi-kubernetes/sdk/v4-4.33.0 branch July 27, 2026 10:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rdimitrov