chore(deps): bump the go group across 1 directory with 8 updates by dependabot[bot] · Pull Request #884 · open-component-model/ocm-controller

dependabot · 2026-04-07T08:48:20Z

Bumps the go group with 6 updates in the / directory:

Package	From	To
github.com/distribution/distribution/v3	`3.0.0`	`3.1.0`
github.com/fluxcd/helm-controller/api	`1.5.2`	`1.5.3`
github.com/google/go-containerregistry	`0.21.2`	`0.21.4`
k8s.io/api	`0.35.2`	`0.35.3`
k8s.io/apiextensions-apiserver	`0.35.2`	`0.35.3`
ocm.software/ocm	`0.37.0`	`0.38.0`

Updates github.com/distribution/distribution/v3 from 3.0.0 to 3.1.0

Release notes

Sourced from github.com/distribution/distribution/v3's releases.

v3.1.0

Welcome to the v3.1.0 release of registry!

This is a stable release

Please try out the release binaries and report any issues at https://github.com/distribution/distribution/issues.

Notable Changes

Fixes CVE-2026-35172

Fixes CVE-2026-33540

Adds support for tag pagination (#4360, #4353)

Fixes default credentials in Azure storage provider (#4619)

Drops support for go1.23 and go1.24 and updates to go1.25

See the full changelog below for the full list of changes.

What's Changed

docs: Update to refer to new image tag v3 by @schanzel in distribution/distribution#4373

Fix default_credentials in azure storage provider by @switchboardOp in distribution/distribution#4619

chore: make function comment match function name by @closeobserve in distribution/distribution#4622

build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory by @dependabot[bot] in distribution/distribution#4625

fix: implement JWK thumbprint for Ed25519 public keys by @zhangyoufu in distribution/distribution#4626

fix: Annotate code block from validation.indexes configuration docs by @anzoman in distribution/distribution#4629

feat: extract redis config to separate struct by @shanduur in distribution/distribution#4620

Fix: resolve issue #4478 by using a temporary file for non-append writes by @onporat in distribution/distribution#4624

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in distribution/distribution#4645

docs: Add note about OTEL_TRACES_EXPORTER by @jcpunk in distribution/distribution#4669

fix: set OTEL traces to disabled by default by @jcpunk in distribution/distribution#4671

Fix markdown syntax for OTEL traces link in docs by @shantanoo-desai in distribution/distribution#4676

Switch UUIDs to UUIDv7 by @binaryfire in distribution/distribution#4666

refactor: replace map iteration with maps.Copy/Clone by @whosehang in distribution/distribution#4632

s3-aws: fix build for 386 by @ChenQi1989 in distribution/distribution#4642

docs: Add OpenTelemetry links to quickstart docs (#4270) by @dpw13 in distribution/distribution#4640

Fix S3 driver loglevel param by @milosgajdos in distribution/distribution#4617

Fixed data race in TestSchedule test by @horoshev in distribution/distribution#4647

Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys by @gpgenaiz in distribution/distribution#4684

build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in distribution/distribution#4687

Fix broken link to Docker Hub fair use policy by @Klikini in distribution/distribution#4688

fix(registry/handlers/app): redis CAs by @ChandonPierre in distribution/distribution#4668

build(deps): bump actions/labeler from 5 to 6 by @dependabot[bot] in distribution/distribution#4694

build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in distribution/distribution#4693

build(deps): bump actions/upload-pages-artifact from 3 to 4 by @dependabot[bot] in distribution/distribution#4691

build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in distribution/distribution#4706

build(deps): bump github/codeql-action from 3.26.5 to 4.30.7 by @dependabot[bot] in distribution/distribution#4710

build(deps): bump github/codeql-action from 4.30.7 to 4.30.8 by @dependabot[bot] in distribution/distribution#4714

chore: labeler: add area/client mapping for internal/client/** by @artem-tkachuk in distribution/distribution#4716

client: add Accept headers to Exists() HEAD by @artem-tkachuk in distribution/distribution#4715

feat(registry): Make graceful shutdown test robust by @Sumedhvats in distribution/distribution#4720

... (truncated)

Commits

708f8d6 chore(ci): Prep for v3.1 release (#4841)
b1d5dbc chore(ci): Prep for v3.1 release
078b078 Merge commit from fork
cccd0d4 fix(vendor): fix broke vendor validation (#4839)
49447e8 fix(vendor): fix broke vendpor validation
cc5d5fa Merge commit from fork
4cfa178 build(deps): bump actions/configure-pages from 5.0.0 to 6.0.0 (#4834)
c4bac3b build(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0 (#4836)
2f2ce9f Opt: refactor tag list pagination support (#4353)
6a02a0e Opt: refactor tag list pagination support
Additional commits viewable in compare view

Updates github.com/fluxcd/helm-controller/api from 1.5.2 to 1.5.3

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.5.3

Changelog

v1.5.3 changelog

Container images

docker.io/fluxcd/helm-controller:v1.5.3

ghcr.io/fluxcd/helm-controller:v1.5.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.5.3

Release date: 2026-03-16

This patch release fixes templating errors for charts that include --- in the content, e.g. YAML separators, embedded scripts, CAs inside ConfigMaps, etc. Some of the errors that could be encountered due to this issue are:

invalid document separator: ---apiVersion: v1

wrong node kind

Fixes:

Fix multi-doc parser of --- for post renderers #1442

Commits

61606cd Merge pull request #1444 from fluxcd/release-v1.5.3
203743e Release v1.5.3
fab7bdb Add changelog entry for v1.5.3
5423812 Merge pull request #1443 from fluxcd/backport-1442-to-release/v1.5.x
4f66b36 Fix multi-doc parser of --- for post renderers
See full diff in compare view

Updates github.com/google/go-containerregistry from 0.21.2 to 0.21.4

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.4

What's Changed

go.mod: do not make a viral minimum go version by @howardjohn in google/go-containerregistry#2237

Avoid pruning absolute links from extracted and flattened images by @Subserial in google/go-containerregistry#2241

Bump the go-deps group across 3 directories with 5 updates by @dependabot[bot] in google/go-containerregistry#2245

fix: update to go1.25.8, and use separate .go-version file by @thaJeztah in google/go-containerregistry#2246

Bump CI go version to 1.26.1 by @Subserial in google/go-containerregistry#2242

Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group by @dependabot[bot] in google/go-containerregistry#2240

fork distribution client v3 auth-challenge as an internal package (squashed) by @thaJeztah in google/go-containerregistry#2248

transport: validate Bearer realm URL to prevent SSRF by @evilgensec in google/go-containerregistry#2243

revert path traversal and symlink escape from #2227 by @Subserial in google/go-containerregistry#2250

Fix pkg/v1/google/auth tests for arm64 by @Subserial in google/go-containerregistry#2085

goreleaser: Update goreleaser config and GH action by @Subserial in google/go-containerregistry#2253

New Contributors

@evilgensec made their first contribution in google/go-containerregistry#2243

Full Changelog: google/go-containerregistry@v0.21.3...v0.21.4

v0.21.3

What's Changed

Adds local file support to the crane index subcommand by @edwardthiele in google/go-containerregistry#2223

migrate to github.com/moby/moby modules by @thaJeztah in google/go-containerregistry#2228

Bump the go-deps group across 4 directories with 7 updates by @dependabot[bot] in google/go-containerregistry#2233

Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group by @dependabot[bot] in google/go-containerregistry#2220

mutate: reject path traversal and symlink escape in Extract by @KevinZhao in google/go-containerregistry#2227

tarball: detect symlink cycles in extractFileFromTar by @vnykmshr in google/go-containerregistry#2232

bump golang to 1.25.7 by @Subserial in google/go-containerregistry#2236

New Contributors

@edwardthiele made their first contribution in google/go-containerregistry#2223

@thaJeztah made their first contribution in google/go-containerregistry#2228

@KevinZhao made their first contribution in google/go-containerregistry#2227

@vnykmshr made their first contribution in google/go-containerregistry#2232

Full Changelog: google/go-containerregistry@v0.21.2...v0.21.3

Commits

e8813dd goreleaser: Update goreleaser config and GH action for releases (#2253)
e90447d replace gcloud in binary calls in pkg/v1/google tests (#2085)
0d0368c revert path traversal and symlink escape changes (#2250)
a2f47d4 transport: validate Bearer realm URL to prevent SSRF (#2243)
19a36cd fork distribution client v3 auth-challenge as an internal package (squashed) ...
c612a9b Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group (#2240)
8f92f59 Bump CI go version to 1.26.1 (#2242)
c99e7cf fix: update to go1.25.8, and use separate .go-version file (#2246)
0794660 Bump the go-deps group across 3 directories with 5 updates (#2245)
4cb93ae Undo pruning absolute links from extracted and flattened images (#2241)
Additional commits viewable in compare view

Updates k8s.io/api from 0.35.2 to 0.35.3

Commits

3897036 Update dependencies to v0.35.3 tag
See full diff in compare view

Updates k8s.io/apiextensions-apiserver from 0.35.2 to 0.35.3

Commits

073f527 Update dependencies to v0.35.3 tag
791831a Merge pull request #136903pohly/automated-cherry-pick-of-#136455
85fbdc0 Merge pull request #136387vikasbolla/automated-cherry-pick-of-#135567
0e52304 fake client-go: un-deprecate NewSimpleClientset
f4ff589 Fix flaky TestApplyCRDuringCRDFinalization test
See full diff in compare view

Updates k8s.io/apimachinery from 0.35.2 to 0.35.3

Commits

See full diff in compare view

Updates k8s.io/client-go from 0.35.2 to 0.35.3

Commits

4f1f0a2 Update dependencies to v0.35.3 tag
f80003c Merge pull request #136903pohly/automated-cherry-pick-of-#136455
8b41556 fake client-go: un-deprecate NewSimpleClientset
See full diff in compare view

Updates ocm.software/ocm from 0.37.0 to 0.38.0

Release notes

Sourced from ocm.software/ocm's releases.

v0.38.0

What's Changed

🐛 Bug Fixes

fix(deps): Fix dependency bump by updating another deprecated dependency by @frewilhelm in open-component-model/ocm#1856

⬆️ Dependencies

chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 by @dependabot[bot] in open-component-model/ocm#1839

chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in open-component-model/ocm#1844

chore(deps): bump the go group with 15 updates by @dependabot[bot] in open-component-model/ocm#1843

chore(deps): bump golang from 1.25.7-alpine3.22 to 1.26.1-alpine3.22 by @dependabot[bot] in open-component-model/ocm#1854

chore(deps): update to go 1.26.1 by @matthiasbruns in open-component-model/ocm#1859

🧰 Maintenance

chore: bump VERSION to 0.38.0-dev by @ocmbot[bot] in open-component-model/ocm#1837

Full Changelog: open-component-model/ocm@v0.37...v0.38.0

v0.38.0-rc.1

What's Changed

🐛 Bug Fixes

fix(deps): Fix dependency bump by updating another deprecated dependency by @frewilhelm in open-component-model/ocm#1856

⬆️ Dependencies

chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 by @dependabot[bot] in open-component-model/ocm#1839

chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in open-component-model/ocm#1844

chore(deps): bump the go group with 15 updates by @dependabot[bot] in open-component-model/ocm#1843

chore(deps): bump golang from 1.25.7-alpine3.22 to 1.26.1-alpine3.22 by @dependabot[bot] in open-component-model/ocm#1854

chore(deps): update to go 1.26.1 by @matthiasbruns in open-component-model/ocm#1859

🧰 Maintenance

chore: bump VERSION to 0.38.0-dev by @ocmbot[bot] in open-component-model/ocm#1837

Full Changelog: open-component-model/ocm@v0.37...v0.38.0

Commits

3eb9aca chore(deps): bump the ci group with 2 updates (#1862)
b6505ee chore(deps): update to go 1.26.1 (#1859)
452293d chore(deps): bump golang from 1.25.7-alpine3.22 to 1.26.1-alpine3.22 (#1854)
d81c446 chore: update 'flake.nix' (#1857)
f17c4a2 fix(deps): Fix dependency bump by updating another deprecated dependency (#1856)
7a23813 chore(deps): bump the ci group with 3 updates (#1852)
58d60e7 chore(deps): bump the ci group with 2 updates (#1851)
42a2371 chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 in the ci grou...
9719ab8 chore(deps): bump github/codeql-action from 4.32.4 to 4.32.5 in the ci group ...
f4caccf chore(deps): bump the ci group with 2 updates (#1847)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) | `3.0.0` | `3.1.0` | | [github.com/fluxcd/helm-controller/api](https://github.com/fluxcd/helm-controller) | `1.5.2` | `1.5.3` | | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.2` | `0.21.4` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.35.2` | `0.35.3` | | [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.35.2` | `0.35.3` | | [ocm.software/ocm](https://github.com/open-component-model/ocm) | `0.37.0` | `0.38.0` | Updates `github.com/distribution/distribution/v3` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/distribution/distribution/releases) - [Commits](distribution/distribution@v3.0.0...v3.1.0) Updates `github.com/fluxcd/helm-controller/api` from 1.5.2 to 1.5.3 - [Release notes](https://github.com/fluxcd/helm-controller/releases) - [Changelog](https://github.com/fluxcd/helm-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/helm-controller@v1.5.2...v1.5.3) Updates `github.com/google/go-containerregistry` from 0.21.2 to 0.21.4 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.2...v0.21.4) Updates `k8s.io/api` from 0.35.2 to 0.35.3 - [Commits](kubernetes/api@v0.35.2...v0.35.3) Updates `k8s.io/apiextensions-apiserver` from 0.35.2 to 0.35.3 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](kubernetes/apiextensions-apiserver@v0.35.2...v0.35.3) Updates `k8s.io/apimachinery` from 0.35.2 to 0.35.3 - [Commits](kubernetes/apimachinery@v0.35.2...v0.35.3) Updates `k8s.io/client-go` from 0.35.2 to 0.35.3 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.35.2...v0.35.3) Updates `ocm.software/ocm` from 0.37.0 to 0.38.0 - [Release notes](https://github.com/open-component-model/ocm/releases) - [Changelog](https://github.com/open-component-model/ocm/blob/main/RELEASE_PROCESS.md) - [Commits](open-component-model/ocm@v0.37...v0.38) --- updated-dependencies: - dependency-name: github.com/distribution/distribution/v3 dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/helm-controller/api dependency-version: 1.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/api dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/apimachinery dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: k8s.io/client-go dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: ocm.software/ocm dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Apr 7, 2026

dependabot bot requested a review from a team as a code owner April 7, 2026 08:48

dependabot bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Apr 7, 2026

frewilhelm enabled auto-merge (squash) April 7, 2026 08:48

frewilhelm approved these changes Apr 7, 2026

View reviewed changes

frewilhelm merged commit 40bf192 into main Apr 7, 2026
9 checks passed

frewilhelm deleted the dependabot/go_modules/go-b282791110 branch April 7, 2026 08:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the go group across 1 directory with 8 updates#884

chore(deps): bump the go group across 1 directory with 8 updates#884
frewilhelm merged 1 commit intomainfrom
dependabot/go_modules/go-b282791110

dependabot bot commented on behalf of github Apr 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Apr 7, 2026

v3.1.0

Notable Changes

What's Changed

v1.5.3

Changelog

Container images

1.5.3

v0.21.4

What's Changed

New Contributors

v0.21.3

What's Changed

New Contributors

v0.38.0

What's Changed

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

v0.38.0-rc.1

What's Changed

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant