[scality-renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
k8s.io/api	v0.35.9 → v0.37.1
k8s.io/apimachinery	v0.35.9 → v0.37.1
k8s.io/client-go	v0.35.9 → v0.37.1

---

Release Notes

kubernetes/api (k8s.io/api)

v0.37.1

Compare Source

v0.37.0

Compare Source

v0.36.6

Compare Source

v0.36.5

Compare Source

v0.36.4

Compare Source

v0.36.3

Compare Source

v0.36.2

Compare Source

v0.36.1

Compare Source

v0.36.0

Compare Source

v0.35.10

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

v0.37.1

Compare Source

v0.37.0

Compare Source

v0.36.6

Compare Source

v0.36.5

Compare Source

v0.36.4

Compare Source

v0.36.3

Compare Source

v0.36.2

Compare Source

v0.36.1

Compare Source

v0.36.0

Compare Source

v0.35.10

Compare Source

kubernetes/client-go (k8s.io/client-go)

v0.37.1

Compare Source

v0.37.0

Compare Source

v0.36.6

Compare Source

v0.36.5

Compare Source

v0.36.4

Compare Source

v0.36.3

Compare Source

v0.36.2

Compare Source

v0.36.1

Compare Source

v0.36.0

Compare Source

v0.35.10

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[scality-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 10 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package	Change
github.com/emicklei/go-restful/v3	v3.12.2 -> v3.13.0
github.com/fxamacker/cbor/v2	v2.9.0 -> v2.9.1
github.com/go-openapi/jsonpointer	v0.21.0 -> v1.0.0
github.com/go-openapi/jsonreference	v0.20.2 -> v1.0.0
github.com/go-openapi/swag	v0.23.0 -> v0.27.1
go.yaml.in/yaml/v2	v2.4.3 -> v2.4.4
golang.org/x/time	v0.9.0 -> v0.15.0
k8s.io/klog/v2	v2.130.1 -> v2.140.0
k8s.io/kube-openapi	v0.0.0-20250910181357-589584f1c912 -> v0.0.0-20260721132016-d427ff9ee9ad
sigs.k8s.io/structured-merge-diff/v6	v6.3.2-0.20260122202528-d9cc6641c482 -> v6.4.2

[github-actions]

Dependency Bump Evaluation

Version change: k8s.io/api, k8s.io/apimachinery, k8s.io/client-go v0.37.0 -> v0.37.1 (effective diff vs main)
Semver bump type: patch

Note: the PR title/body still say v0.35.9 -> v0.37.1, but main has since moved to v0.37.0 (with controller-runtime v0.25.2), so after rebase the actual diff is only 4 lines in go.mod and 8 in go.sum. This comment replaces the earlier evaluation, which was written against the old v0.35.9 base.

Changes:

• Upstream v0.37.0...v0.37.1 for each of api, apimachinery and client-go is a single commit, "Update dependencies to v0.37.1 tag", touching only go.mod/go.sum (Kubernetes staging publish re-tag)
• Transitive k8s.io/streaming v0.37.0 -> v0.37.1
• No Go source changes in the bumped modules

Breaking changes: None

Security concerns: None. No code changes, no new dependencies, and no CVEs referenced.

Impact on codebase: None. The project uses only stable APIs (metav1, api/errors, runtime.Scheme, types, fields, client-go scheme/rest/auth plugins), mostly through controller-runtime v0.25.2, which already targets v0.37.x. Indirect k8s.io deps (apiserver, apiextensions-apiserver, component-base) stay at v0.37.0. That is harmless patch-level skew.

Recommendation: REVIEW REQUIRED

Notes:

• The change itself is low-risk and would otherwise be SAFE TO MERGE. It is marked REVIEW REQUIRED for two reasons: auto-approval is limited to dependabot-authored PRs (this one is from scality-renovate), and build, lint and unit-test checks were still running when this was written.
• Merge once CI is green.

— Claude Code

[ezekiel-alexrod]

LGTM