Skip to content

Conversation

@skitt
Copy link
Contributor

@skitt skitt commented Sep 30, 2025

Summary

This is the last version in the 3.18 branch, before the bump to k8s 0.34 dependencies. It cleans up the jsonschema transitive dependencies.

Related issue(s)

Fixes #

Summary by CodeRabbit

  • Security
    • Incorporates upstream security patches from updated third‑party libraries to reduce vulnerabilities.
  • Performance
    • Minor performance and reliability improvements due to refreshed underlying dependencies.
  • Bug Fixes
    • Inherits upstream fixes improving compatibility and stability across recent environments.
  • Chores
    • Updated core platform dependencies to current patch versions, ensuring better compatibility and ongoing support.
    • Added/adjusted indirect libraries for standards-compliant data handling, improving robustness without changing user workflows.

@coderabbitai
Copy link

coderabbitai bot commented Sep 30, 2025

Walkthrough

Upgrades dependency versions in go.mod, including Helm v3.18.6, Kubernetes modules to v0.33.3, spf13/pflag to v1.0.7, several golang.org/x packages, and yaml/jsonschema libraries; adds an indirect dependency on santhosh-tekuri/jsonschema/v6.

Changes

Cohort / File(s) Summary
Dependency updates
go.mod
Bump: helm.sh/helm/v3→v3.18.6; spf13/pflag→v1.0.7; k8s.io/{api,apiextensions-apiserver,apimachinery,apiserver,client-go,component-base}→v0.33.3; k8s.io/kms→v0.33.3. Update: golang.org/x/{crypto→v0.40.0,net→v0.41.0,sync→v0.16.0,sys→v0.34.0,term→v0.33.0,text→v0.27.0}; sigs.k8s.io/yaml→v1.5.0; gopkg.in/{yaml.v2→v2.4.2,yaml.v3→v3.0.3}. Add indirect: github.com/santhosh-tekuri/jsonschema/v6.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

Suggested labels

lgtm

Suggested reviewers

  • zhiweiyin318
  • qiujian16

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Description Check ⚠️ Warning The pull request description follows the repository template by including the required Summary and Related issue(s) sections and provides a clear summary of the version bump and dependency cleanup, but the Related issue(s) section still contains the placeholder “Fixes #” with no actual issue number, leaving it incomplete. Please update the Related issue(s) section to reference a valid issue number or explicitly state that there are no related issues instead of leaving the placeholder “Fixes #.”
✅ Passed checks (2 passed)
Check name Status Explanation
Title Check ✅ Passed The title “🌱 Bump to Helm 3.18.6” concisely and accurately highlights the primary change—upgrading to Helm version 3.18.6—and correctly uses the seedling emoji prefix to indicate a miscellaneous change, making it clear and specific for readers.
Docstring Coverage ✅ Passed No functions found in the changes. Docstring coverage check skipped.
✨ Finishing touches
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c8a4fa7 and 9048b08.

⛔ Files ignored due to path filters (162)
  • go.sum is excluded by !**/*.sum
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/.gitmodules is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/.golangci.yml is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/.pre-commit-hooks.yaml is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/.swp is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/LICENSE is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/README.md is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/compiler.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/content.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/draft.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/format.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/go.work is excluded by !**/*.work, !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/go.work.sum is excluded by !**/*.sum, !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/kind/kind.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/loader.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft-04/schema is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft-06/schema is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft-07/schema is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2019-09/meta/applicator is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2019-09/meta/content is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2019-09/meta/core is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2019-09/meta/format is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2019-09/meta/meta-data is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2019-09/meta/validation is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2019-09/schema is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2020-12/meta/applicator is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2020-12/meta/content is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2020-12/meta/core is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2020-12/meta/format-annotation is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2020-12/meta/format-assertion is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2020-12/meta/meta-data is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2020-12/meta/unevaluated is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2020-12/meta/validation is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/metaschemas/draft/2020-12/schema is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/objcompiler.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/output.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/position.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/root.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/roots.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/schema.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/util.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/validator.go is excluded by !vendor/**
  • vendor/github.com/santhosh-tekuri/jsonschema/v6/vocab.go is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/README.md is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/bool_func.go is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/count.go is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/errors.go is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/flag.go is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/func.go is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/golangflag.go is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/ipnet_slice.go is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/text.go is excluded by !vendor/**
  • vendor/github.com/spf13/pflag/time.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonpointer/README.md is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonpointer/pointer.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonreference/LICENSE-APACHE-2.0.txt is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonreference/README.md is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonreference/reference.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/.gitignore is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/.travis.yml is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/LICENSE-APACHE-2.0.txt is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/README.md is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/draft.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/errors.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/format_checkers.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/glide.yaml is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/internalLog.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/jsonContext.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/jsonLoader.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/locales.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/result.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/schema.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/schemaLoader.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/schemaPool.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/schemaReferencePool.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/schemaType.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/subSchema.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/types.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/utils.go is excluded by !vendor/**
  • vendor/github.com/xeipuuv/gojsonschema/validation.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/.travis.yml is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/LICENSE is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/LICENSE.libyaml is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/NOTICE is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/README.md is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/apic.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/decode.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/emitterc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/encode.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/parserc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/readerc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/resolve.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/scannerc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/sorter.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/writerc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/yaml.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/yamlh.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v2/yamlprivateh.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/LICENSE is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/NOTICE is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/README.md is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/apic.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/decode.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/emitterc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/encode.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/parserc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/readerc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/resolve.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/scannerc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/sorter.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/writerc.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/yaml.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/yamlh.go is excluded by !vendor/**
  • vendor/go.yaml.in/yaml/v3/yamlprivateh.go is excluded by !vendor/**
  • vendor/golang.org/x/net/http2/frame.go is excluded by !vendor/**
  • vendor/golang.org/x/net/trace/events.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_386.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_arm.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_mips.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_386.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_arm.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_mips.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go is excluded by !vendor/**
  • vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go is excluded by !vendor/**
  • vendor/helm.sh/helm/v3/pkg/chartutil/dependencies.go is excluded by !vendor/**
  • vendor/helm.sh/helm/v3/pkg/chartutil/jsonschema.go is excluded by !vendor/**
  • vendor/k8s.io/apiserver/pkg/storage/cacher/delegator.go is excluded by !vendor/**
  • vendor/modules.txt is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/.travis.yml is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/goyaml.v2/OWNERS is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/goyaml.v2/README.md is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/goyaml.v2/yaml_aliases.go is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/goyaml.v3/OWNERS is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/goyaml.v3/README.md is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/goyaml.v3/patch.go is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/goyaml.v3/yaml_aliases.go is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/yaml.go is excluded by !vendor/**
  • vendor/sigs.k8s.io/yaml/yaml_go110.go is excluded by !vendor/**
📒 Files selected for processing (1)
  • go.mod (4 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
  • GitHub Check: unit
  • GitHub Check: e2e
  • GitHub Check: integration
  • GitHub Check: e2e-cloudevents
  • GitHub Check: e2e-hosted
  • GitHub Check: verify
🔇 Additional comments (5)
go.mod (5)

115-116: YAML library versions updated.

The YAML libraries have been updated (go.yaml.in/yaml/v2 to v2.4.2 and v3 to v3.0.3), which is consistent with the overall dependency refresh in this PR.


136-142: Kubernetes-related indirect dependencies updated consistently.

The k8s.io/kms and sigs.k8s.io/yaml packages have been updated to match the Kubernetes 0.33.3 version bump, maintaining consistency across the dependency tree.


117-124: golang.org/x package versions validated. All specified versions (v0.40.0, v0.41.0, v0.16.0, v0.34.0, v0.33.0, v0.27.0) exist and can be used as indirect dependencies.


95-95: Approve JSON schema indirect dependency addition. Confirmed that santhosh-tekuri/jsonschema/[email protected] is a transitive dependency of helm.sh/helm/[email protected] and the version exists.


13-22: Direct dependency versions validated. Helm v3.18.6, spf13/pflag v1.0.7, and Kubernetes modules (all at v0.33.3) are present on proxy.golang.org. Please audit for known vulnerabilities (for example, run go list -m all | go vuln).


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🧪 Early access (Sonnet 4.5): enabled

We are currently testing the Sonnet 4.5 model, which is expected to improve code review quality. However, this model may lead to increased noise levels in the review comments. Please disable the early access features if the noise level causes any inconvenience.

Note:

  • Public repositories are always opted into early access features.
  • You can enable or disable early access features from the CodeRabbit UI or by updating the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@skitt skitt changed the title Bump to Helm 3.18.6 🌱 Bump to Helm 3.18.6 Sep 30, 2025
This is the last version in the 3.18 branch, before the bump to k8s
0.34 dependencies. It cleans up the jsonschema transitive
dependencies.

Signed-off-by: Stephen Kitt <[email protected]>
@zhujian7
Copy link
Member

zhujian7 commented Oct 2, 2025

/lgtm
/approve

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 2, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: skitt, zhujian7

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved label Oct 2, 2025
@openshift-merge-bot openshift-merge-bot bot merged commit 535e709 into open-cluster-management-io:main Oct 2, 2025
15 checks passed
@skitt skitt deleted the helm-3.18.6 branch October 31, 2025 13:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants