chore(deps): bump the go group with 9 updates by dependabot[bot] · Pull Request #960 · open-component-model/ocm-controller

dependabot · 2026-07-05T15:04:15Z

Bumps the go group with 9 updates:

Package	From	To
cuelang.org/go	`0.16.1`	`0.17.0`
github.com/fluxcd/helm-controller/api	`1.6.0`	`1.6.1`
github.com/fluxcd/kustomize-controller/api	`1.9.0`	`1.9.1`
github.com/fluxcd/pkg/apis/event	`0.27.0`	`0.28.0`
github.com/fluxcd/pkg/apis/meta	`1.30.0`	`1.30.1`
github.com/fluxcd/pkg/kustomize	`1.35.0`	`1.36.0`
github.com/fluxcd/pkg/runtime	`0.110.0`	`0.111.0`
github.com/fluxcd/source-controller/api	`1.9.0`	`1.9.1`
ocm.software/ocm	`0.44.0`	`0.45.0`

Updates cuelang.org/go from 0.16.1 to 0.17.0

Release notes

Sourced from cuelang.org/go's releases.

v0.17.0

Changes which may break some users are marked below with: ⚠️

Language

The active try experiment renames the new fallback keyword, used with for comprehensions, to otherwise. fallback continues to be accepted for now, but is rewritten to the new form.

The active aliasv2 experiment now allows ~(X) as an alternative to ~X for the single postfix alias form. ~X is also rewritten as ~(X) for the sake of consistency and clarity.

Language versions v0.17.0 and later allow omitting commas in multi-line lists. Just like a newline after a struct field implies a comma, a newline after a list element now implies a comma as well.

Language versions v0.17.0 and later allow a newline or a comma before the closing bracket of an index expression, matching how lists and func arguments allow omitting trailing commas.

The language spec is tweaked to make $ a valid identifier, which was already allowed by the parser and evaluator.

⚠️ Support for the infix div, mod, quo, and rem operators has been removed. Since late 2020, these infix forms have been undocumented and rewritten by cue fix to the new function calls.

The new shortcircuit experiment

This release introduces the shortcircuit experiment, which changes the && and || operators to not evaluate the right operand if the left operand alone determines the result.

This matches the behavior already documented in the CUE spec and is consistent with most mainstream languages, but for the sake of a smooth transition for end users, we are rolling out this change via an experiment.

You can try this experiment via the @experiment(shortcircuit) file attribute. To mimic the old behavior with the experiment, you can use a hidden field:
_y: Y
if X && _y {}
Evaluator

Comprehensions

The comprehension algorithm now waits to run a comprehension's body until the fields it reads have a concrete value, rather than trying to produce its fields up front. This resolves a number of long-standing bugs, most notably the last known regressions from evalv2, where a comprehension that should have resolved instead failed as an incomplete value or a cycle.

This design also greatly simplifies upcoming evaluator work, such as introducing new builtins to replace comparing values to bottom, as well as the design of evalv4.

Other changes

The evaluator no longer deduplicates errors just by position, which was causing some useful errors from disjunctions or standard library calls to be dropped incorrectly.

Several long-standing cycle-detection bugs have been fixed, such as self-referential uses of matchN and matchIf, self-feeding disjunctions, and comprehensions that read a let binding which refers back to the comprehension's own fields.

Fixed a bug where the same package imported via different qualified import paths (e.g. foo.com/bar@v0 or foo.com/bar:baz) did not share the same hidden field namespace.

Resolving an unversioned import from a dependency module now respects that module's own default major version, instead of always using the main module's default.

Fix a number of issues where cue def could produce invalid CUE output, such as due to name conflicts.

... (truncated)

Commits

0fc639b [release-branch.v0.17] internal/mod: resolve module replacements via minimum-...
e73658d cue/format: revert #4296 regression test
c3f08a1 cue/format: revert manual-AST field alignment fix
60e1bb7 cue/format: revert issue #1006 test cases
3f7aafe cue/format: revert list and call argument column alignment fix
e2eb7f5 cue/format: revert spurious empty line fix
0fa6c09 cue/format: revert Option-behavior test
1e07f16 cue/format: revert default tab width change from 8 to 4
7190842 cue/format: revert multiline string interpolation indentation fix
8d2db9d internal/cueexperiment: teach v0.17 about the formatv2 experiment
Additional commits viewable in compare view

Updates github.com/fluxcd/helm-controller/api from 1.6.0 to 1.6.1

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.6.1

Changelog

v1.6.1 changelog

Container images

docker.io/fluxcd/helm-controller:v1.6.1

ghcr.io/fluxcd/helm-controller:v1.6.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.6.1

Release date: 2026-06-30

This patch release updates Kubernetes to 1.36.2, Helm to v4.2.2 and the fluxcd/pkg dependencies. It also adds kubectl categories to the HelmRelease CRD and documents the controller's command-line options.

Improvements:

Add categories to the HelmRelease CRD #1527

Document controller options #1531

Update fluxcd/pkg dependencies #1529

Commits

2695d9b Merge pull request #1534 from fluxcd/release-v1.6.1
88a2a94 Release v1.6.1
bc8a9b7 Add changelog entry for v1.6.1
e6f1c2a Merge pull request #1531 from fluxcd/backport-1530-to-release/v1.6.x
2a654f3 Document controller options
ad59a32 Merge pull request #1529 from fluxcd/update-pkg-deps/release/v1.6.x
d914efa Fix rollback remediation test
2a53c96 Update fluxcd/pkg dependencies
9291c6b Merge pull request #1527 from fluxcd/backport-1526-to-release/v1.6.x
7ef29e9 Add categories to the HelmRelease CRD
See full diff in compare view

Updates github.com/fluxcd/kustomize-controller/api from 1.9.0 to 1.9.1

Release notes

Sourced from github.com/fluxcd/kustomize-controller/api's releases.

v1.9.1

Changelog

v1.9.1 changelog

Container images

docker.io/fluxcd/kustomize-controller:v1.9.1

ghcr.io/fluxcd/kustomize-controller:v1.9.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/kustomize-controller/api's changelog.

1.9.1

Release date: 2026-06-30

This patch release updates Kubernetes to 1.36.2 and the fluxcd/pkg dependencies, adds kubectl categories to the Kustomization CRD and documents the controller's command-line options.

Improvements:

Add categories to the Kustomization CRD #1682

Document controller options #1685

Update fluxcd/pkg dependencies #1683

Commits

ab0e492 Merge pull request #1688 from fluxcd/release-v1.9.1
e662cf5 Release v1.9.1
81ce5ce Add changelog entry for v1.9.1
edb530f Merge pull request #1685 from fluxcd/backport-1684-to-release/v1.9.x
67492b3 Document controller options
400f51d Merge pull request #1683 from fluxcd/update-pkg-deps/release/v1.9.x
49497d0 Update fluxcd/pkg dependencies
63abb7e Merge pull request #1682 from fluxcd/backport-1681-to-release/v1.9.x
1ffc1bf Add categories to the Kustomization CRD
See full diff in compare view

Updates github.com/fluxcd/pkg/apis/event from 0.27.0 to 0.28.0

Commits

00782ed Merge pull request #917 from fluxcd/test-auth-providers
3976c50 [RFC-0010] Add tests for auth providers
182841a Merge pull request #916 from fluxcd/cache-op-label
1e41450 Introduce operation label for cache event metric
aa3cde9 Merge pull request #909 from fluxcd/auth-azure
9e0e8bc [RFC-0010] Add azure auth library
7eae091 Merge pull request #908 from fluxcd/auth-gcp
9f68942 Merge pull request #907 from fluxcd/auth-aws
bb7cb58 Merge pull request #906 from fluxcd/auth-core
45fbfee [RFC-0010] Add gcp auth library
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/apis/meta from 1.30.0 to 1.30.1

Commits

5043306 Merge pull request #1252 from fluxcd/release-flux/v2.9.x
af21909 Prepare for release
4017623 Merge pull request #1254 from fluxcd/backport-1253-to-flux/v2.9.x
b1fd0e1 Upgrade kubernetes to 1.36.2
635d7a0 Merge pull request #1250 from fluxcd/backport-1249-to-flux/v2.9.x
2864946 Upgrade go-git-providers and go-github
ae10469 Merge pull request #1246 from fluxcd/ks-always-subst
2cd36cb kustomize: add tests for empty vars with strict sub and omitted without
ca2a7aa kustomize: introduce option for always substituting
d884940 Merge pull request #1245 from fluxcd/release-main
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/kustomize from 1.35.0 to 1.36.0

Commits

b98e2b0 Merge pull request #1251 from fluxcd/release-main
2dfcb7c Prepare for release
dd6b016 Merge pull request #1253 from fluxcd/upgrade-k8s-36.2
2d00796 Upgrade kubernetes to 1.36.2
827f6c3 Merge pull request #1249 from fluxcd/upgrade-go-git-providers
be6d462 Upgrade go-git-providers and go-github
023a357 Merge pull request #1248 from fluxcd/label-2.9
7e8856d Add backport label for Flux 2.9
See full diff in compare view

Updates github.com/fluxcd/pkg/runtime from 0.110.0 to 0.111.0

Commits

b98e2b0 Merge pull request #1251 from fluxcd/release-main
2dfcb7c Prepare for release
dd6b016 Merge pull request #1253 from fluxcd/upgrade-k8s-36.2
2d00796 Upgrade kubernetes to 1.36.2
827f6c3 Merge pull request #1249 from fluxcd/upgrade-go-git-providers
be6d462 Upgrade go-git-providers and go-github
023a357 Merge pull request #1248 from fluxcd/label-2.9
7e8856d Add backport label for Flux 2.9
ae10469 Merge pull request #1246 from fluxcd/ks-always-subst
2cd36cb kustomize: add tests for empty vars with strict sub and omitted without
Additional commits viewable in compare view

Updates github.com/fluxcd/source-controller/api from 1.9.0 to 1.9.1

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.9.1

Changelog

v1.9.1 changelog

Container images

docker.io/fluxcd/source-controller:v1.9.1

ghcr.io/fluxcd/source-controller:v1.9.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.9.1

Release date: 2026-06-30

This patch release updates Kubernetes to 1.36.2 and the fluxcd/pkg dependencies, adds kubectl categories to the source-controller CRDs and documents the controller's command-line options.

Improvements:

Add categories to source-controller CRDs #2090

Document controller options #2094

Update fluxcd/pkg dependencies #2092

Commits

092bcff Merge pull request #2096 from fluxcd/release-v1.9.1
cae78f3 Release v1.9.1
6c1005d Add changelog entry for v1.9.1
c82dd36 Merge pull request #2094 from fluxcd/backport-2093-to-release/v1.9.x
b597999 Document controller options
aa0bfbc Merge pull request #2092 from fluxcd/update-pkg-deps/release/v1.9.x
5dab445 Update fluxcd/pkg dependencies
25140d8 Merge pull request #2090 from fluxcd/backport-2087-to-release/v1.9.x
60fb997 Add categories to source-controller CRDs
See full diff in compare view

Updates ocm.software/ocm from 0.44.0 to 0.45.0

Release notes

Sourced from ocm.software/ocm's releases.

v0.45.0

What's Changed

🐛 Bug Fixes

fix(brew): generate canonical Formula/ocm.rb alongside versioned pin by @fabianburth in open-component-model/ocm#1997

fix(s3): handle 301 redirect in bucket region detection by @jakobmoellerdev in open-component-model/ocm#2000

⬆️ Dependencies

chore(deps): bump the go group with 18 updates by @dependabot[bot] in open-component-model/ocm#1994

chore: use go 1.26.4 by @frewilhelm in open-component-model/ocm#2003

chore(deps): bump the go group with 21 updates by @dependabot[bot] in open-component-model/ocm#2004

🧰 Maintenance

chore: bump VERSION to 0.45.0-dev by @ocmbot[bot] in open-component-model/ocm#1986

chore(fix): update coc to linux foundation eu by @Skarlso in open-component-model/ocm#1987

chore: use ubuntu-latest instead of large_runner runner by @frewilhelm in open-component-model/ocm#1989

chore(releases-045): cherry-pick: add env-var gated repository-exist call (#1996) by @frewilhelm in open-component-model/ocm#2010

New Contributors

@knp-sap made their first contribution in open-component-model/ocm#1946

Full Changelog: open-component-model/ocm@v0.44...v0.45.0

v0.45.0-rc.2

What's Changed

🐛 Bug Fixes

fix(brew): generate canonical Formula/ocm.rb alongside versioned pin by @fabianburth in open-component-model/ocm#1997

fix(s3): handle 301 redirect in bucket region detection by @jakobmoellerdev in open-component-model/ocm#2000

⬆️ Dependencies

chore(deps): bump the go group with 18 updates by @dependabot[bot] in open-component-model/ocm#1994

chore: use go 1.26.4 by @frewilhelm in open-component-model/ocm#2003

chore(deps): bump the go group with 21 updates by @dependabot[bot] in open-component-model/ocm#2004

🧰 Maintenance

chore: bump VERSION to 0.45.0-dev by @ocmbot[bot] in open-component-model/ocm#1986

chore(fix): update coc to linux foundation eu by @Skarlso in open-component-model/ocm#1987

chore: use ubuntu-latest instead of large_runner runner by @frewilhelm in open-component-model/ocm#1989

chore(releases-045): cherry-pick: add env-var gated repository-exist call (#1996) by @frewilhelm in open-component-model/ocm#2010

New Contributors

@knp-sap made their first contribution in open-component-model/ocm#1946

Full Changelog: open-component-model/ocm@v0.44...v0.45.0

v0.45.0-rc.1

What's Changed

... (truncated)

Commits

6d105cb fix: normalize Docker Hub single-component refs with library/ prefix (#1946)
bf3c54c chore(deps): bump rojopolis/spellcheck-github-actions from 0.60.0 to 0.61.0 i...
a9b6025 chore: update 'flake.nix' (#2005)
78c260b chore(deps): bump the go group with 21 updates (#2004)
e5693d3 chore: use go 1.26.4 (#2003)
6d8be25 chore: update 'flake.nix' (#2001)
c87a0c3 fix(s3): handle 301 redirect in bucket region detection (#2000)
6f08a66 fix(brew): generate canonical Formula/ocm.rb alongside versioned pin (#1997)
778eddb chore: update 'flake.nix' (#1995)
b4cd7aa chore(deps): bump the go group with 18 updates (#1994)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 9 updates: | Package | From | To | | --- | --- | --- | | [cuelang.org/go](https://github.com/cue-lang/cue) | `0.16.1` | `0.17.0` | | [github.com/fluxcd/helm-controller/api](https://github.com/fluxcd/helm-controller) | `1.6.0` | `1.6.1` | | [github.com/fluxcd/kustomize-controller/api](https://github.com/fluxcd/kustomize-controller) | `1.9.0` | `1.9.1` | | [github.com/fluxcd/pkg/apis/event](https://github.com/fluxcd/pkg) | `0.27.0` | `0.28.0` | | [github.com/fluxcd/pkg/apis/meta](https://github.com/fluxcd/pkg) | `1.30.0` | `1.30.1` | | [github.com/fluxcd/pkg/kustomize](https://github.com/fluxcd/pkg) | `1.35.0` | `1.36.0` | | [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.110.0` | `0.111.0` | | [github.com/fluxcd/source-controller/api](https://github.com/fluxcd/source-controller) | `1.9.0` | `1.9.1` | | [ocm.software/ocm](https://github.com/open-component-model/ocm) | `0.44.0` | `0.45.0` | Updates `cuelang.org/go` from 0.16.1 to 0.17.0 - [Release notes](https://github.com/cue-lang/cue/releases) - [Commits](cue-lang/cue@v0.16.1...v0.17.0) Updates `github.com/fluxcd/helm-controller/api` from 1.6.0 to 1.6.1 - [Release notes](https://github.com/fluxcd/helm-controller/releases) - [Changelog](https://github.com/fluxcd/helm-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/helm-controller@v1.6.0...v1.6.1) Updates `github.com/fluxcd/kustomize-controller/api` from 1.9.0 to 1.9.1 - [Release notes](https://github.com/fluxcd/kustomize-controller/releases) - [Changelog](https://github.com/fluxcd/kustomize-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/kustomize-controller@v1.9.0...v1.9.1) Updates `github.com/fluxcd/pkg/apis/event` from 0.27.0 to 0.28.0 - [Commits](fluxcd/pkg@git/v0.27.0...git/v0.28.0) Updates `github.com/fluxcd/pkg/apis/meta` from 1.30.0 to 1.30.1 - [Commits](fluxcd/pkg@apis/meta/v1.30.0...apis/meta/v1.30.1) Updates `github.com/fluxcd/pkg/kustomize` from 1.35.0 to 1.36.0 - [Commits](fluxcd/pkg@kustomize/v1.35.0...kustomize/v1.36.0) Updates `github.com/fluxcd/pkg/runtime` from 0.110.0 to 0.111.0 - [Commits](fluxcd/pkg@runtime/v0.110.0...runtime/v0.111.0) Updates `github.com/fluxcd/source-controller/api` from 1.9.0 to 1.9.1 - [Release notes](https://github.com/fluxcd/source-controller/releases) - [Changelog](https://github.com/fluxcd/source-controller/blob/main/CHANGELOG.md) - [Commits](fluxcd/source-controller@v1.9.0...v1.9.1) Updates `ocm.software/ocm` from 0.44.0 to 0.45.0 - [Release notes](https://github.com/open-component-model/ocm/releases) - [Changelog](https://github.com/open-component-model/ocm/blob/main/RELEASE_PROCESS.md) - [Commits](open-component-model/ocm@v0.44...v0.45) --- updated-dependencies: - dependency-name: cuelang.org/go dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/helm-controller/api dependency-version: 1.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/kustomize-controller/api dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/pkg/apis/event dependency-version: 0.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/pkg/apis/meta dependency-version: 1.30.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/fluxcd/pkg/kustomize dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/pkg/runtime dependency-version: 0.111.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/fluxcd/source-controller/api dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: ocm.software/ocm dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Jul 5, 2026

dependabot Bot requested a review from a team as a code owner July 5, 2026 15:04

dependabot Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. labels Jul 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the go group with 9 updates#960

chore(deps): bump the go group with 9 updates#960
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-683083baa1

dependabot Bot commented on behalf of github Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 5, 2026

v0.17.0

Language

The new shortcircuit experiment

Evaluator

Comprehensions

Other changes

v1.6.1

Changelog

Container images

1.6.1

v1.9.1

Changelog

Container images

1.9.1

v1.9.1

Changelog

Container images

1.9.1

v0.45.0

What's Changed

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

New Contributors

v0.45.0-rc.2

What's Changed

🐛 Bug Fixes

⬆️ Dependencies

🧰 Maintenance

New Contributors

v0.45.0-rc.1

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

The new `shortcircuit` experiment