[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/cobaltcore-dev/openstack-hypervisor-operator	v1.2.3 → v1.3.0
github.com/onsi/ginkgo/v2	v2.33.0 → v2.33.1
github.com/prometheus/common	v0.73.0 → v0.73.1
github.com/slack-go/slack	v0.29.0 → v0.33.0
github.com/vmware/govmomi	v0.56.0 → v0.56.2
k8s.io/api	v0.37.1 → v0.37.2
k8s.io/apimachinery	v0.37.1 → v0.37.2
k8s.io/client-go	v0.37.1 → v0.37.2
sigs.k8s.io/controller-runtime	v0.25.1 → v0.25.2

---

Release Notes

cobaltcore-dev/openstack-hypervisor-operator (github.com/cobaltcore-dev/openstack-hypervisor-operator)

v1.3.0: better eviction

Compare Source

v1.3.0

Parallel VM migrations while draining hypervisors, safe eviction completion, and hardened offboarding.

⚠️ Upgrade notes

• --agent-namespaces is now required. The operator refuses to start without it. It controls the namespaces searched for agent pods (nova-compute, neutron) during offboarding. Helm users are not affected (chart default: monsoon3); anyone deploying the image directly or with customized values must set controllerManager.manager.env.agentNamespaces (comma-separated).
• New optional chart values controllerManager.manager.env.evictionConcurrency (default "1") and evictionTraitConcurrency (default empty).

New features

Parallel VM migrations while draining a hypervisor (#​365)

Drains previously migrated VMs strictly one at a time; you can now run multiple live migrations in flight with a configurable limit:

• --eviction-concurrency — default maximum number of concurrent migrations (default 1, i.e. the previous serial behavior)
• --eviction-trait-concurrency — per-trait overrides, e.g. CUSTOM_HANA_EXCLUSIVE_HOST=1,CUSTOM_FOO=2; the lowest matching trait limit wins
• Helm chart exposes both as evictionConcurrency / evictionTraitConcurrency values (rendered as EVICTION_CONCURRENCY / EVICTION_TRAIT_CONCURRENCY env vars)

Eviction completes only after incoming migrations settle

A host could previously be declared evicted while Nova still had migrations in flight targeting it (Nova keeps instances associated with the source host while a live migration runs). The operator now queries Nova's /os-migrations and, before declaring a hypervisor evicted:

• aborts abortable incoming live-migrations (queued / preparing / running) aimed at the host
• waits for non-abortable ones (evacuations, post-migrating state)
• adds an IncomingMigrationsSettled condition to the Hypervisor CR (reasons Settled, AbortingIncomingMigrations, WaitingForIncomingMigrations); a failed Nova check blocks eviction and is visible in status instead of being silently ignored

Hardened offboarding

• The kvm.cloud.sap/offboarding NoExecute taint is applied only after all VMs are evicted (Evicting=False), so agent pods are no longer pushed off a node mid-migration
• Compute-service (Nova service entry) deletion is gated on a new AgentPodsEvicted condition on the Hypervisor CR — a running nova-compute pod would otherwise re-register the service immediately after deletion
• HA protection is kept until successfully onboarded hosts are drained; a successful onboarding is no longer overwritten during maintenance

Node termination detection via deletionTimestamp

Gardener is moving away from setting the legacy Terminating node condition toward simply deleting the Node. The Hypervisor Terminating condition — and MaintenanceTermination seeding at CR creation — now trigger on the legacy condition or node.deletionTimestamp.

Reliability & performance

• GOMEMLIMIT is set from the container memory limit so the Go GC respects the cgroup limit (prevents OOM kills)
• OpenStack provider clients are cached per auth context — the Keystone service catalog is deserialized once instead of once per controller
• Deployment/PodDisruptionBudget informers scoped to the maintenance objects in kube-system only (smaller cache footprint)
• The Gardener node-lifecycle signal pod now exits promptly on SIGTERM

Internals

• HypervisorMaintenanceController migrated to server-side apply for status updates and Eviction creation (new SSA condition helpers in internal/utils)
• Eviction controller extracted into its own internal/controller/eviction package
• Onboarding controller made testable (injectable clients, requeue interval); --version now works without the other runtime flags
• CRDs regenerated with controller-gen v0.22.0 (doc fixes only; no schema changes beyond the new conditions)

Dependencies & tooling

• Go 1.26 → 1.27; k8s.io/* 0.36 → 0.37.1; controller-runtime 0.24 → 0.25.2
• gophercloud v2.12 → v2.15.0; cert-manager v1.20 → v1.21; sapcc/go-api-declarations 1.22 → 1.25
• Security: OpenTelemetry → v1.45.0; ginkgo v2.33.1; actions/checkout v7; actions/stale v11

Full Changelog: cobaltcore-dev/openstack-hypervisor-operator@v1.2.3...v1.3.0

onsi/ginkgo (github.com/onsi/ginkgo/v2)

v2.33.1

Compare Source

Fixes

• Add several missing fields to spec report JSON output.

prometheus/common (github.com/prometheus/common)

v0.73.1

Compare Source

What's Changed

• build(deps): bump github.com/pandatix/go-abnf from 0.5.1 to 0.5.3 by @​bwplotka in #​1027

Full Changelog: prometheus/common@v0.73.0...v0.73.1

slack-go/slack (github.com/slack-go/slack)

v0.33.0

Compare Source

This release adds support for Slackbot skills (changelog) and Slack's new block kit layout block (changelog).

• Slackbot skills: all seven slackbot.skills.* methods are supported. You can create, inspect, update, and delete skills, list them, and also manage your personal library.
• Admin skills: all admin.slackbot.skills.* are supported as well.
• Layout blocks: arrange existing blocks into rows and columns, with widths, alignment, borders, whilst allowing fallback for older clients (through blocks).

Full Changelog: slack-go/slack@v0.32.0...v0.33.0

v0.32.0

Compare Source

This release expands Slack Code support with channel views, context bars, and canvas collaboration, and fixes permission diagnostics, slash-command decoding, and workflow-button validation.

[!IMPORTANT]
Please read all the notes below, not just the breaking changes. Some changes deserve paying close attention to, like new fields in SlackResponse, and all the new *AgentConversation* methods.

Breaking changes

• Update interfaces, mocks, and function values that use the old canvas creation
  signatures. CreateCanvas and CreateCanvasContext now accept
  options ...CreateCanvasOption. Existing direct calls still compile, but these
  methods no longer satisfy interfaces with the old fixed signatures. Add the
  variadic parameter to interface and mock declarations; adapt stored function
  values or wrap the call in a function with the old signature.
• Use field names when initializing Properties, SlackResponse,
  KickUserFromConversationSlackResponse, or SlackErrorResponse. New fields
  make positional literals fail to compile. Existing keyed literals still work.

Added

• Show code diffs, HTML reports, Block Kit interfaces, and canvases in Slack Code
  channels. Use SetAgentConversationView to publish or update a view,
  ListAgentConversationViews to discover attached views, and
  RemoveAgentConversationView to remove them. All have Context variants.
  Slack documents pull-request views too, but live requests have returned
  invalid_view_type; publish a unified diff with AgentViewTypeDiff if that
  happens.
• Give a code channel useful context. Set context-bar links, action items,
  a summary message, and external resource details with
  SetAgentConversationProperties or its Context variant. Read session status,
  title, assigned agents, origin message, context-bar ownership, summary, and
  managed views through Properties.AgentSession and Properties.CodeChannel
  in conversation responses.
• Read and revise canvases attached to code channels.
  GetAgentConversationCanvas retrieves markdown and comment threads, including
  replies and optional resolved threads. SetAgentConversationCanvasContent
  replaces the markdown while preserving section IDs and comment anchors on
  unchanged sections. Both have Context variants.
• Create a canvas directly in a channel, including in free workspaces that
  require a channel. Pass CreateCanvasOptionChannelID(channelID) to
  CreateCanvas or CreateCanvasContext (#​1623).
• Try the new examples/slack_code CLI for channel
  setup, context bars, views, canvases, commands, metadata inspection, and archival.
  It includes sample HTML, Block Kit, markdown, and unified-diff files.

Fixed

• See which scopes are missing when an API call fails. Slack's needed and
  provided values are now preserved in responses and SlackErrorResponse, even
  for methods that return only an error. Use errors.As to inspect Needed and
  Provided; the error text is unchanged.
• Discover code-channel views even when Slack returns an empty legacy views
  array. ListAgentConversationViews also preserves session_views, including
  view types, names, and owner IDs.
• Receive slash commands when Slack omits is_enterprise_install. JSON
  decoding now accepts absent or null values, including observed Slack Code
  context-bar action deliveries over Socket Mode.
• Send workflow buttons without an action ID. An empty
  WorkflowButtonBlockElement.ActionID is omitted from JSON so the button passes
  Slack's block validation. Populated IDs are preserved.

Documentation and testing

• Clarify that Slack documents raw_number table cells for publishing. If a
  workspace rejects them with invalid_blocks, send the number as a
  TableRawTextCell. Null cells remain a received-only representation.
• Add regression coverage for code-channel lifecycle events, Block Kit view
  interactions, and agent slash commands through the existing HTTP and Socket
  Mode parsers and handlers.

Full Changelog: slack-go/slack@v0.31.0...v0.32.0

v0.31.0

Compare Source

Breaking changes

• ButtonBlockElement is no longer comparable because VisibleToUserIDs is a slice.
  Value comparisons and map keys using it no longer compile; interface comparisons containing button values can panic. Use comparable identifiers as map keys and compare button contents explicitly:

  // Before
  same := a == b
  // After (import "reflect")
  same := reflect.DeepEqual(a, b)

• If you create these structs without naming their fields, update that code. New fields were added to Block Kit elements, Attachment, File, RemoteFile and Features. Code that supplies values by position now fails to compile. Include the field names, or use the existing New... helper functions where available:

  // Before: values depend on field order.
  element := slack.RichTextSectionBroadcastElement{slack.RTSEBroadcast, "here"}
  // After: each value names its field.
  element := slack.RichTextSectionBroadcastElement{
      Type:  slack.RTSEBroadcast,
      Range: "here",
  }

• Newly supported rich-text elements decode into concrete types instead of *RichTextSectionUnknownElement. Update type assertions and switches for attachment, workflow, Work Object and message mentions; tags; canvas elements; citations; file and List record references; and Salesforce data fields.

• Request signature validation is stricter, and mismatch errors have changed. NewSecretsVerifier rejects signatures without the v0= prefix or whose decoded length is not 32 bytes. Update any test fixtures that relied on the previous permissive parsing. SecretsVerifier.Ensure returns ErrInvalidSignature on a mismatch; replace checks of the old error text with errors.Is(err, slack.ErrInvalidSignature).

• UninstallApp and RotateTokens now use POST, including their Context variants. Update mocks or custom transports that expect GET requests or credentials in the URL to accept form-encoded POST bodies.

• OptionOnWarning callbacks no longer receive the token parameter in form or query parameter maps. Update callbacks that rely on that field.

Added

• Add RTMOptionReadLimit and socketmode.OptionReadLimit to limit incoming WebSocket message sizes on every connection, including reconnects. The default remains unlimited; exceeding a configured limit closes the connection and triggers normal reconnect handling. With compression enabled through a custom dialer, the limit counts compressed bytes and does not bound the size after decompression.

• Block Kit: Add typed Salesforce data fields with record IDs, field metadata, label visibility, and styles. These now decode into RichTextSectionSalesforceDataFieldElement instead of RichTextSectionUnknownElement.

  [!WARNING]
  has_withheld_salesforce_field_names is based on live Slack responses and is absent from the reference and SDK models.

• Block Kit: Add typed workflow mentions with workflow and trigger IDs, display text, URLs, message locations, and styles. These now decode into RichTextSectionWorkflowMentionElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed Work Object mentions with entity and app IDs, display text, URLs, icons, preview settings, product names, and styles. These now decode into RichTextSectionWorkObjectMentionElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed attachment mentions with app, entity, icon, message, preview, and product metadata. These now decode into RichTextSectionAttachmentMentionElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed rich-text tags with styles and constants for all nine colors. Tags now decode into RichTextSectionTagElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed List record references with record and view IDs, display text, URLs, and styles. These now decode into RichTextSectionListRecordElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed canvas user mentions and canvas message unfurls, including thread IDs and styles. These now decode into concrete types instead of RichTextSectionUnknownElement.

• Block Kit: Add typed canvas rich-text elements with labels, section links, title visibility, styles, and skill metadata. These now decode into RichTextSectionCanvasElement instead of RichTextSectionUnknownElement.

• Block Kit: Add RichTextSectionCitationElement with typed file, external, web, message, and memory details for rich-text citations. Preserve unknown detail variants as raw JSON. Citations now decode into this concrete type instead of RichTextSectionUnknownElement.

• Block Kit: Add typed file
  and message mention
  rich-text elements, including styles and optional metadata. These now decode into concrete
  types instead of RichTextSectionUnknownElement.

• Add image alt text, GIF, PDF, 800px and inline thumbnails, audio and transcription metadata, preview truncation, remote file identifiers, canvas and List metadata, title blocks, and sharing and app metadata to File. Preserve sharing and app metadata in RemoteFile responses.

• Block Kit: Add missing element fields for button accessibility, agent prompts, visibility, conversation selection, rich-text input sizing, and rich-text styles and metadata, including shared emoji URLs.

• Add IsShare, IsMsgUnfurl and Files to Attachment, so the files of a forwarded message are decoded rather than dropped.

• Add CreateAgentConversation and ArchiveAgentConversation (plus Context variants) for agents.conversations.create and agents.conversations.archive.

• Add SetAgentConversationCommands (plus Context variant) and Features.CodeChannels for agent slash commands.

• Add all 12 Slack Lists API methods, with Context variants and scoped options for lists, access, items, and exports.

• Block Kit: Add DataTableActionCell for buttons in data_table blocks, with an optional raw_text or raw_number fallback (#​1618).

• Add AdminAppsApprovedList and AdminAppsRestrictedList (plus Context variants) for the admin.apps.approved.list and admin.apps.restricted.list methods, with typed app, scope and pagination responses (#​1614).

• Add AdminAppsRequestsList (plus Context variant) for the admin.apps.requests.list method, with typed request and pagination responses (#​1615).

• File now unmarshals the video fields of the file object: the video thumbnail (ThumbVideo, ThumbVideoW, ThumbVideoH and ThumbVideoTimestamp) and DurationMs, HLS, HLSEmbed, HLSPreview, MediaDisplayType, MP4, MP4Low and VTT.

Fixed

• RTM: Keep reader errors scoped to their connection and stop the old reader before reconnecting, so stale errors cannot close the next connection.
• slackevents.ParseEvent returns an error for an event_callback with a missing or null inner event instead of panicking.
• Release multipart upload writers when a request fails or returns before consuming the request body.

Full Changelog: slack-go/slack@v0.30.1...v0.31.0

v0.30.1

Compare Source

[!IMPORTANT]
This is a security release. Upgrade if your app passes file URLs from messages or events to GetFile. Full details are in CHANGELOG.md.

Security

GetFile, GetFileContext and UploadToURL now send the token only to https URLs on slack.com, slack-gov.com and their subdomains, and to the host set with OptionAPIURL. Any other URL returns an error before a request is made.

The url_private of a remote or external file (File.IsExternal) points outside Slack, so GetFile(file.URLPrivate) sent the token to that host. See GHSA-3q3v-34v2-g88f.

A test that points GetFile at an httptest server must also pass that server to OptionAPIURL:

api := slack.New("xoxb-test", slack.OptionAPIURL(ts.URL+"/"))
err := api.GetFile(ts.URL+"/files-pri/T1-F1/a.txt", &buf)

Thanks to @​Lordseriouspig (what a handle... 😂) for the report.

Full Changelog: slack-go/slack@v0.30.0...v0.30.1

v0.30.0

Compare Source

[!WARNING]
This release has breaking changes. It needs Go 1.26 or later, DeleteFileComment takes its arguments in a new order, and four methods have new variadic signatures that break interfaces and mocks. Read Breaking changes before you upgrade. Full details are in CHANGELOG.md.

Breaking changes

DeleteFileComment takes (fileID, commentID)

DeleteFileComment now uses the same argument order as DeleteFileCommentContext (#​1611). Swap the arguments of every call:

// Before
err := api.DeleteFileComment(commentID, fileID)
// After
err := api.DeleteFileComment(fileID, commentID)

The compiler cannot catch this because both arguments are strings. A call that still passes a comment ID (Fc…) will return an error in order to try to catch it. YMMV so please raise an issue if you encounter issues

Variadic options on CreateManifest and GetUserInfo

CreateManifest, CreateManifestContext, GetUserInfo and GetUserInfoContext now take variadic options. An interface or mock that declares the old signature needs the new parameter:

// Before
type slackAPI interface {
      GetUserInfo(user string) (*slack.User, error)
      CreateManifest(manifest *slack.Manifest, token string) (*slack.ManifestResponse, error)
}

// After
type slackAPI interface {
      GetUserInfo(user string, options ...slack.GetUserInfoOption) (*slack.User, error)
      CreateManifest(manifest *slack.Manifest, token string, options ...slack.CreateManifestOption) (*slack.ManifestResponse, error)
}

Other

• The minimum supported Go version is now 1.26 (#​1581).
• UpdateUserGroupsParams has a new slice field, AdditionalChannels, so it can no longer be compared with == or used as a map key (#​1599).

Added

• Agent messaging events (app_context_changed, agent_session_stopped, agent_session_title_changed), AppContext on AppHomeOpenedEvent and MessageEvent, authorizations on EventsAPICallbackEvent, and SetAgentSessionStatus and RenameAgentSession for agents.sessions.* by @​rliddler in #​1607
• AppId, Credentials and OAuthAuthorizeUrl in the CreateManifest response by @​sivchari in #​1587
• Features.AgentView and Features.AssistantView app manifest settings by @​yuya-takeyama in #​1589
• More app manifest keys, so a typed export and update keeps them: Features.UnfurlDomains, Features.RichPreviews, Features.Search, OAuthConfig.PKCEEnabled, OAuthConfig.TokenManagementEnabled, Settings.IsMCPEnabled, Settings.TokenRotationEnabled, Settings.IncomingWebhooks, Settings.FunctionRuntime, Settings.SIWSLinks, EventSubscriptions.MetadataSubscriptions and OutgoingDomains by @​nlopes in #​1609, #​1610 and #​1612
• Attachment.HideColor and Block Kit TaskCardBlock.HideTitle by @​mkende in #​1590
• additional_channels and include_count options for usergroups.create and usergroups.update by @​JaiminBrahmbhatt in #​1599
• SetAppIcon for apps.icon.set by @​JaiminBrahmbhatt in #​1597
• AdminTeamsList for admin.teams.list by @​JaiminBrahmbhatt in #​1593
• AdminUsersList for admin.users.list by @​JaiminBrahmbhatt in #​1595
• New UserGroup fields: AutoProvision, ChannelCount, EnterpriseSubteamID, IsEditingRestricted, IsIDPGroup, IsMembershipLocked, IsOrgLevel, IsSection, IsSubteam and IsVisible by @​JaiminBrahmbhatt in #​1605
• GetUsersOptionIncludeLocale and GetUserInfoOptionIncludeLocale to choose whether users.list and users.info return locale by @​JaiminBrahmbhatt in #​1603 and @​nlopes in #​1613
• CreateManifestRaw, UpdateManifestRaw, ExportManifestRaw and ValidateManifestRaw, which keep manifest keys that Manifest does not model, and CreateManifestOptionTeamID by @​JaiminBrahmbhatt in #​1601

Changed

• Go 1.26 is the minimum supported version, and CI covers Go 1.26 and 1.27 by @​nlopes in #​1581
• DeleteFileComment takes (fileID, commentID) by @​nlopes in #​1611

Fixed

• Socket Mode and RTM reconnects wait at most 5 minutes between attempts, and RetryConfig.BackoffMax caps the Web API retry delay, by @​shushenghong in #​1586
• Socket Mode reconnects when the stream ends in the middle of a TLS record instead of panicking by @​shushenghong in #​1608
• GetFile returns an error when the token cannot read the file instead of saving the sign-in page by @​richardmilles in #​1582

Other

• chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @​dependabot[bot] in #​1584

New Contributors

• @​rliddler made their first contribution in #​1607
• @​shushenghong made their first contribution in #​1586
• @​yuya-takeyama made their first contribution in #​1589
• @​mkende made their first contribution in #​1590
• @​JaiminBrahmbhatt made their first contribution in #​1599
• @​richardmilles made their first contribution in #​1582

Full Changelog: slack-go/slack@v0.29.0...v0.30.0

vmware/govmomi (github.com/vmware/govmomi)

v0.56.2

Compare Source

Release v0.56.2

Release Date: 2026-10-26

🐞 Fix

• [c128513] return error from toolbox Run if process not found (#​4149)

🧹 Chore

• [10a792c] Update version.go for v0.56.2
• [b4dd7a8] use setup-go with check-latest
• [2db454e] output go version with release dryrun

⚠️ BREAKING

📖 Commits

• [10a792c] chore: Update version.go for v0.56.2
• [b4dd7a8] chore: use setup-go with check-latest
• [2db454e] chore: output go version with release dryrun
• [c128513] fix: return error from toolbox Run if process not found (#​4149)

v0.56.1

Compare Source

Release v0.56.1

Release Date: 2026-10-23

🧹 Chore

• [e45bf1c] Update version.go for v0.56.1

⚠️ BREAKING

📖 Commits

• [e45bf1c] chore: Update version.go for v0.56.1

kubernetes/api (k8s.io/api)

v0.37.2

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

v0.37.2

Compare Source

kubernetes/client-go (k8s.io/client-go)

v0.37.2

Compare Source

kubernetes-sigs/controller-runtime (sigs.k8s.io/controller-runtime)

v0.25.2

Compare Source

What's Changed

• [release-0.25] 🐛 Fix SubResourceCreateOptions.ApplyToSubResourceCreate by @​k8s-infra-cherrypick-robot in #​3600
• [release-0.25] ✨ Add metrics handler options by @​k8s-infra-cherrypick-robot in #​3603
• [release-0.25] 📖 Document that ReadYourWrite doesn't work correctly with > 1 Namespace by @​k8s-infra-cherrypick-robot in #​3610
• [release-0.25] ✨ Add a metric for the readyourwite consistency wait duration by @​k8s-infra-cherrypick-robot in #​3613

Full Changelog: kubernetes-sigs/controller-runtime@v0.25.1...v0.25.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on Friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/pandatix/go-abnf	v0.5.1 -> v0.5.3
k8s.io/utils	v0.0.0-20260626114624-be93311217bd -> v0.0.0-20260707023825-cf1189d6abe3