fix(deps): update non-minor dependencies by renovate[bot] · Pull Request #84 · SAP/component-operator

renovate · 2026-02-23T07:36:33Z

This PR contains the following updates:

Package	Change	Type	Update
github.com/fluxcd/source-controller/api	`v1.8.0` → `v1.8.1`	require	patch
github.com/getsops/sops/v3	`v3.12.1` → `v3.12.2`	require	patch
github.com/sap/component-operator-runtime	`v0.3.132` → `v0.3.136`	require	patch
github.com/sap/go-generics	`v0.2.53` → `v0.2.56`	require	patch
go (source)	`1.26.0` → `1.26.1`	golang	patch
k8s.io/apiextensions-apiserver	`v0.35.1` → `v0.35.2`	require	patch
k8s.io/apimachinery	`v0.36.0-alpha.1` → `v0.36.0-alpha.2`	require	patch
k8s.io/client-go	`v0.35.1` → `v0.35.2`	require	patch
k8s.io/code-generator	`v0.35.1` → `v0.35.2`	require	patch
sigs.k8s.io/controller-runtime	`v0.23.1` → `v0.23.3`	require	patch
sigs.k8s.io/controller-runtime/tools/setup-envtest	`e4c1c38` → `6c9615a`	require	digest

Release Notes

fluxcd/source-controller (github.com/fluxcd/source-controller/api)

`v1.8.1`

Compare Source

Changelog

v1.8.1 changelog

Container images

docker.io/fluxcd/source-controller:v1.8.1
ghcr.io/fluxcd/source-controller:v1.8.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

getsops/sops (github.com/getsops/sops/v3)

`v3.12.2`

Compare Source

Installation

To install sops, download one of the pre-built binaries provided for your platform from the artifacts attached to this release.

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.linux.amd64

# Move the binary in to your PATH
mv sops-v3.12.2.linux.amd64 /usr/local/bin/sops

# Make the binary executable
chmod +x /usr/local/bin/sops

Verify checksums file signature

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.checksums.txt
curl -LO https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.checksums.pem
curl -LO https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.checksums.sig

# Verify the checksums file
cosign verify-blob sops-v3.12.2.checksums.txt \
  --certificate sops-v3.12.2.checksums.pem \
  --signature sops-v3.12.2.checksums.sig \
  --certificate-identity-regexp=https://github.com/getsops \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature:

# Verify the binary using the checksums file
sha256sum -c sops-v3.12.2.checksums.txt --ignore-missing

Verify artifact provenance

The SLSA provenance of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an in-toto link metadata file named sops-v3.12.2.intoto.jsonl. To verify the provenance of an artifact, you can utilize the slsa-verifier tool:

# Download the metadata file
curl -LO  https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.intoto.jsonl

# Verify the provenance of the artifact
slsa-verifier verify-artifact <artifact> \
  --provenance-path sops-v3.12.2.intoto.jsonl \
  --source-uri github.com/getsops/sops \
  --source-tag v3.12.2

Container Images

The sops binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies.

These container images are available for the following architectures: linux/amd64 and linux/arm64.

GitHub Container Registry

ghcr.io/getsops/sops:v3.12.2
ghcr.io/getsops/sops:v3.12.2-alpine

Quay.io

quay.io/getsops/sops:v3.12.2
quay.io/getsops/sops:v3.12.2-alpine

Verify container image signature

The container images are signed using Cosign with GitHub OIDC. To validate the signature of an image, run the following command:

cosign verify ghcr.io/getsops/sops:v3.12.2 \
  --certificate-identity-regexp=https://github.com/getsops \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  -o text

Verify container image provenance

The container images include SLSA provenance attestations. For more information around the verification of this, please refer to the slsa-verifier documentation.

Software Bill of Materials

The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an SPDX JSON file, formatted as <binary>.spdx.sbom.json.

What's Changed

CI: Rearrange steps; disable setup-go's caching by @felixfontein in #2081
build(deps): Bump the go group with 6 updates by @dependabot[bot] in #2085
build(deps): Bump the ci group with 2 updates by @dependabot[bot] in #2084
build(deps): Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 by @dependabot[bot] in #2087
build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in #2089
build(deps): Bump the ci group with 4 updates by @dependabot[bot] in #2091
build(deps): Bump tempfile from 3.25.0 to 3.26.0 in /functional-tests in the rust group by @dependabot[bot] in #2090
build(deps): Bump github.com/docker/cli from 28.0.4+incompatible to 29.2.0+incompatible by @dependabot[bot] in #2095
build(deps): Bump the ci group with 4 updates by @dependabot[bot] in #2101
Check for metadata key(s) before re-encrypting file by @felixfontein in #2098
fix: handle mac only encrypted flag in global by @CzBiX in #2100
sops edit: delete temporary file on termination by @felixfontein in #2104
build(deps): Bump the ci group with 4 updates by @dependabot[bot] in #2106
build(deps): Bump tempfile from 3.26.0 to 3.27.0 in /functional-tests in the rust group by @dependabot[bot] in #2105
Revert "Merge pull request #1697 from onjen/fix-1142" by @felixfontein in #2099
Release 3.12.2 by @felixfontein in #2109

New Contributors

@CzBiX made their first contribution in #2100

Full Changelog: getsops/sops@v3.12.1...v3.12.2

sap/component-operator-runtime (github.com/sap/component-operator-runtime)

sap/go-generics (github.com/sap/go-generics)

`v0.2.56`

Compare Source

`v0.2.55`

Compare Source

`v0.2.54`

Compare Source

golang/go (go)

`v1.26.1`

kubernetes/apiextensions-apiserver (k8s.io/apiextensions-apiserver)

`v0.35.2`

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

`v0.36.0-alpha.2`

Compare Source

kubernetes/client-go (k8s.io/client-go)

`v0.35.2`

Compare Source

kubernetes/code-generator (k8s.io/code-generator)

`v0.35.2`

Compare Source

kubernetes-sigs/controller-runtime (sigs.k8s.io/controller-runtime)

`v0.23.3`

Compare Source

What's Changed

🐛 Ensure DefaulterRemoveUnknownOrOmitableFields is still working even if objects are equal by @k8s-infra-cherrypick-robot in #3469

Full Changelog: kubernetes-sigs/controller-runtime@v0.23.2...v0.23.3

`v0.23.2`

Compare Source

What's Changed

🐛 Fix fake client's SSA status patch resource version check by @k8s-infra-cherrypick-robot in #3446
✨ Reduce memory usage of default webhooks by @k8s-infra-cherrypick-robot in #3467

Full Changelog: kubernetes-sigs/controller-runtime@v0.23.1...v0.23.2

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-02-23T07:36:35Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

18 additional dependencies were updated

Details:

Package	Change
`cloud.google.com/go/kms`	`v1.25.0` -> `v1.26.0`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.7` -> `v1.32.9`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.7` -> `v1.19.9`
`github.com/aws/aws-sdk-go-v2/feature/s3/manager`	`v1.22.0` -> `v1.22.2`
`github.com/aws/aws-sdk-go-v2/service/kms`	`v1.49.5` -> `v1.50.0`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.9` -> `v1.30.10`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.13` -> `v1.35.14`
`github.com/cloudflare/circl`	`v1.6.1` -> `v1.6.3`
`github.com/fluxcd/pkg/apis/meta`	`v1.25.0` -> `v1.25.1`
`go.opentelemetry.io/otel`	`v1.39.0` -> `v1.40.0`
`go.opentelemetry.io/otel/metric`	`v1.39.0` -> `v1.40.0`
`go.opentelemetry.io/otel/sdk`	`v1.39.0` -> `v1.40.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.39.0` -> `v1.40.0`
`go.opentelemetry.io/otel/trace`	`v1.39.0` -> `v1.40.0`
`google.golang.org/api`	`v0.266.0` -> `v0.267.0`
`k8s.io/api`	`v0.35.1` -> `v0.35.2`
`k8s.io/kube-aggregator`	`v0.35.0` -> `v0.35.1`
`k8s.io/utils`	`v0.0.0-20260108192941-914a6e750570` -> `v0.0.0-20260210185600-b8788abfbbc2`

renovate bot added dependencies Pull requests that update a dependency file sap-cs-devops labels Feb 23, 2026

renovate bot force-pushed the renovate/non-minor-deps branch 6 times, most recently from 7c91f49 to 40412ad Compare March 5, 2026 13:38

renovate bot force-pushed the renovate/non-minor-deps branch 12 times, most recently from 5de4807 to fa74ab1 Compare March 12, 2026 14:45

renovate bot force-pushed the renovate/non-minor-deps branch 2 times, most recently from e6ba18e to 713ece1 Compare March 18, 2026 09:10

fix(deps): update non-minor dependencies

e92d22d

renovate bot force-pushed the renovate/non-minor-deps branch from 713ece1 to e92d22d Compare March 18, 2026 17:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update non-minor dependencies#84

fix(deps): update non-minor dependencies#84
renovate[bot] wants to merge 1 commit intomainfrom
renovate/non-minor-deps

renovate bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

renovate bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Changelog

Container images

Installation

Verify checksums file signature

Verify binary integrity

Verify artifact provenance

Container Images

GitHub Container Registry

Quay.io

Verify container image signature

Verify container image provenance

Software Bill of Materials

What's Changed

New Contributors

What's Changed

What's Changed

Configuration

Uh oh!

renovate bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Feb 23, 2026 •

edited

Loading

renovate bot commented Feb 23, 2026 •

edited

Loading