[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Updated underlying software components to newer versions. No user-facing features or behavior changes are included in this update.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

Important

Review skipped

We couldn't safely recover the incremental review. No full review was started, and the last reviewed checkpoint was preserved. Retry later, or explicitly request a full review by commenting @coderabbitai full review.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The go.mod file updates direct and indirect dependency versions. It adds indirect OpenAPI middleware and ULID v2 requirements. It removes the indirect ULID v1, OpenTracing, and MongoDB Go driver requirements.

Suggested reviewers: bryan-cox

Priority: Low

Merge Risk: Minimal · previous review 01460

This is a routine dependency update with no identified defects. Normal CI should confirm the build and tests before merge.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The dependency update adds a new Regional Access Boundary request log that can expose an access token. In `vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/regional_access_boundary.go:1…	Do not log the raw authenticated request. Redact or omit Authorization, cookies, API keys, and other credential-bearing headers before constructing the log value, and avoid logging sensitive request or response payloads. Update or patch t…

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: a Dependabot update of 12 miscellaneous dependencies in one directory. It is concise and specific.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes dependency manifests, checksums, and vendored production sources. The authoritative diff contains no _test.go files and no added Ginkgo title calls (It, Describe, `Conte…
Test Structure And Quality	✅ Passed	PASS: The pull request changes dependency manifests, go.sum, and vendored dependency code only. The review-scoped diff contains no *_test.go files and no added Ginkgo constructs such as It, BeforeEach…
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes only dependency metadata (go.mod, go.sum) and vendored dependency files. It does not modify deployment manifests, operator code, or controllers. The diff introduces no top…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only go.mod, go.sum, and vendored dependency files. It adds no Ginkgo e2e tests or other test files, so the IPv4 and external-connectivity conditions do not apply.
No-Weak-Crypto	✅ Passed	PASS. The PR updates Go dependencies and vendored code. The added code contains only crypto/tls and crypto/x509 imports. No added MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB API usage was found. T…
Container-Privileges	✅ Passed	The pull request changes go.mod, go.sum, and vendored dependency files only. It does not change container or Kubernetes manifests. No added lines introduce privileged, hostPID, hostNetwork, hostIPC, S…

Full details: No-Sensitive-Data-In-Logs

Explanation

The dependency update adds a new Regional Access Boundary request log that can expose an access token. In vendor/cloud.google.com/go/auth/internal/regionalaccessboundary/regional_access_boundary.go:124-132, the code puts typ + " " + token.Value into the Authorization header and then logs the request with internallog.HTTPRequest. The formatter in vendor/github.com/googleapis/gax-go/v2/internallog/internallog.go:74-82 serializes every request header without redaction. The path is wired into credential detection by the changed detect.go code and is reachable when Regional Access Boundary support is enabled. Logging is disabled by default, but a configured logger or GOOGLE_SDK_GO_LOGGING_LEVEL can enable it. This matches the check's token exposure condition.

Resolution

Do not log the raw authenticated request. Redact or omit Authorization, cookies, API keys, and other credential-bearing headers before constructing the log value, and avoid logging sensitive request or response payloads. Update or patch the vendored cloud-auth/gax logging implementation and add a regression test that verifies an access-token value never appears in debug logs.

✨ Finishing Touches: 💡 1

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ironcladlou for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dependabot[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-images	d5a3d8f	link	true	/test okd-scos-images
ci/prow/verify	d5a3d8f	link	true	/test verify
ci/prow/rosa-e2e-images	d5a3d8f	link	true	/test rosa-e2e-images
ci/prow/images	d5a3d8f	link	true	/test images
ci/prow/verify-deps	d5a3d8f	link	true	/test verify-deps
ci/prow/unit	d5a3d8f	link	true	/test unit

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.