NO-JIRA: chore(deps): weekly dependabot consolidation

[hypershift-jira-solve-ci]

Summary

Weekly consolidation of dependabot dependency updates.

Consolidated PRs

• build(deps): bump the misc-dependencies group across 1 directory with 7 updates #8845: build(deps): bump the misc-dependencies group across 1 directory with 7 updates
• build(deps): bump the github-dependencies group across 1 directory with 4 updates #8844: build(deps): bump the github-dependencies group across 1 directory with 4 updates

Commits

1. chore(deps): update root module dependencies
2. chore(deps): update vendored dependencies
3. chore: regenerate CRD assets
4. chore: update remaining generated files

---

Assisted-by: Claude (via Claude Code)

---

Note: This PR was auto-generated by the dependabot-triage periodic CI job. See the full report for token usage, cost breakdown, and detailed output.

Summary by CodeRabbit

• Chores
  • Updated the Go toolchain to the latest patch release.
  • Bumped several third-party dependencies, including cloud, testing, database, and Google API packages.
  • Included minor version upgrades across indirect dependencies for improved stability and compatibility.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@hypershift-jira-solve-ci[bot]: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

Weekly consolidation of dependabot dependency updates.

Consolidated PRs

• build(deps): bump the misc-dependencies group across 1 directory with 7 updates #8845: build(deps): bump the misc-dependencies group across 1 directory with 7 updates
• build(deps): bump the github-dependencies group across 1 directory with 4 updates #8844: build(deps): bump the github-dependencies group across 1 directory with 4 updates

Commits

1. chore(deps): update root module dependencies
2. chore(deps): update vendored dependencies
3. chore: regenerate CRD assets
4. chore: update remaining generated files

---

Assisted-by: Claude (via Claude Code)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f836be9e-2da2-402a-9236-546569894645

📥 Commits

Reviewing files that changed from the base of the PR and between 12b0f3d and 64f5e4e.

⛔ Files ignored due to path filters (40)

• cmd/install/assets/crds/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachines.yaml is excluded by !cmd/install/assets/**/*.yaml
• cmd/install/assets/crds/cluster-api-provider-kubevirt/infrastructure.cluster.x-k8s.io_kubevirtmachinetemplates.yaml is excluded by !cmd/install/assets/**/*.yaml
• go.sum is excluded by !**/*.sum
• hack/workspace/go.work is excluded by !**/*.work
• vendor/github.com/aws/aws-sdk-go-v2/service/ec2/CHANGELOG.md is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AttachImageWatermark.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelCapacityReservation.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_ReplaceImageCriteriaInAllowedImagesSettings.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/aws/aws-sdk-go-v2/service/ec2/deserializers.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/aws/aws-sdk-go-v2/service/ec2/go_module_metadata.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/aws/aws-sdk-go-v2/service/ec2/serializers.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/aws/aws-sdk-go-v2/service/ec2/types/types.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/aws/smithy-go/CHANGELOG.md is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/aws/smithy-go/go_module_metadata.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/googleapis/enterprise-certificate-proxy/client/client.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/googleapis/enterprise-certificate-proxy/client/util/util.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/ginkgo/v2/internal/suite.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/config.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/gomega/CHANGELOG.md is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/gomega/README.md is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/onsi/gomega/gomega_dsl.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.etcd.io/etcd/api/v3/version/version.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.etcd.io/etcd/server/v3/etcdserver/api/membership/cluster.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/api/compute/v1/compute-api.json is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/api/compute/v1/compute-gen.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/api/compute/v1/compute2-gen.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/api/compute/v1/compute3-gen.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/api/internal/version.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/api/storage/v1/storage-api.json is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/api/storage/v1/storage-gen.go is excluded by !vendor/**, !**/vendor/**
• vendor/gopkg.in/ini.v1/key.go is excluded by !vendor/**, !**/vendor/**
• vendor/kubevirt.io/api/core/v1/types.go is excluded by !vendor/**, !**/vendor/**
• vendor/kubevirt.io/api/core/v1/types_swagger_generated.go is excluded by !vendor/**, !**/vendor/**
• vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (1)

• go.mod

---

📝 Walkthrough

Walkthrough

This PR updates go.mod to require Go 1.25.8 and refreshes multiple module versions, including AWS SDK v2, smithy-go, Ginkgo/Gomega, etcd modules, kubevirt.io/api, Google API/genproto dependencies, gopkg.in/ini.v1, and github.com/googleapis/enterprise-certificate-proxy.

Possibly related PRs

• openshift/hypershift#8784: Also updates overlapping dependency declarations in go.mod, including AWS SDK v2 and Ginkgo/Gomega versions.

Suggested reviewers

• jparrill
• sdminonne
• bryan-cox

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Topology-Aware Scheduling Compatibility	⚠️ Warning	New control-plane deployment code sets maxUnavailable=0 for 2 replicas, while multizone spread adds required hostname anti-affinity, with no ControlPlaneTopology guard.	Gate the rollout/spread logic on cluster topology, or relax to maxUnavailable>=1 / preferred anti-affinity for 2-node and SNO/TNA clusters.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the dependency consolidation and is concise enough for history scanning.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR diff only changes hack/workspace/go.work; no test files or dynamic Ginkgo titles appear in the diff.
Test Structure And Quality	✅ Passed	Only hack/workspace/go.work changed in the reviewed diff; no Ginkgo test files or test code were modified, so the checklist is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only hack/workspace/go.work changed; no Ginkgo e2e tests or network-sensitive code was added.
No-Weak-Crypto	✅ Passed	PASS: The PR is dependency/generated-file churn; no new weak-crypto code or secret comparisons were added. The only term hits were an http2 cipher-suite blacklist, not enabling weak ciphers.
Container-Privileges	✅ Passed	Changed manifests contain no privileged/hostPID/hostNetwork/hostIPC/SYS_ADMIN/allowPrivilegeEscalation/runAsUser:0/runAsNonRoot:false settings; CRD hostNetwork hits are schema-only.
No-Sensitive-Data-In-Logs	✅ Passed	PR touches deps/generated manifests only; inspected code paths showed no new log statements or secret-bearing log lines.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.12%. Comparing base (12b0f3d) to head (64f5e4e).
⚠️ Report is 114 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8849   +/-   ##
=======================================
  Coverage   43.12%   43.12%           
=======================================
  Files         766      766           
  Lines       94872    94872           
=======================================
  Hits        40909    40909           
  Misses      51115    51115           
  Partials     2848     2848           

Flag	Coverage Δ
cmd-support	36.42% <ø> (ø)
cpo-hostedcontrolplane	45.27% <ø> (ø)
cpo-other	45.10% <ø> (ø)
hypershift-operator	53.28% <ø> (ø)
other	31.69% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-v2-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, hypershift-jira-solve-ci[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-aks | Build: 2074105729261768704 | Cost: $3.14906775 | Failed step: hypershift-azure-run-e2e

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[hypershift-jira-solve-ci]

That's a binary compressed log - not useful. I have all the evidence I need. Let me now compile the complete analysis.

The root cause is clear:

1. The openshift-oauth-apiserver container in pod openshift-oauth-apiserver-66b8fdb877-vr549 crashed once during startup due to etcd connectivity issues
2. It could not connect to etcd-client:2379 - DNS resolution failed initially, then TCP connections were canceled
3. After 20 seconds of trying, it failed with "error building REST storage: context deadline exceeded" and exited with code 1
4. The container then restarted successfully and stayed running
5. The EnsureNoCrashingPods test detected restartCount=1 > 0 (the default crash toleration for non-Kubevirt platforms) and failed the test
6. This is a transient startup race condition - the openshift-oauth-apiserver tried to connect to etcd before etcd DNS was fully resolvable in the hosted control plane namespace
7. The PR changes (dependabot dependency bumps) are completely unrelated to this failure

Test Failure Analysis Complete

Job Information

• Prow Job: pull-ci-openshift-hypershift-main-e2e-aks
• Build ID: 2074105729261768704
• Target: e2e-aks
• Failed Test: TestAzureScheduler/ValidateHostedCluster/EnsureNoCrashingPods
• PR: #8849 — NO-JIRA: chore(deps): weekly dependabot consolidation

Test Failure Analysis

Error

Container openshift-oauth-apiserver in pod openshift-oauth-apiserver-66b8fdb877-vr549 has a restartCount > 0 (1)

Summary

The TestAzureScheduler test failed because the EnsureNoCrashingPods validation detected that the openshift-oauth-apiserver container in the hosted control plane namespace had restarted once (restartCount=1). The container crashed on its first startup attempt because it could not establish a connection to etcd (etcd-client:2379) — first DNS resolution failed, then TCP connections timed out. After 20 seconds the container exited with "error building REST storage: context deadline exceeded" (exit code 1). It restarted successfully and remained healthy. This is a transient hosted control plane startup race condition unrelated to the PR's dependabot dependency bumps. All other tests in this same job run (22 other EnsureNoCrashingPods checks) passed.

Root Cause

The openshift-oauth-apiserver container in pod openshift-oauth-apiserver-66b8fdb877-vr549 (hosted control plane namespace e2e-clusters-dcd6v-azure-scheduler-rfhbf) crashed during its initial startup at 13:01:23Z due to an etcd connectivity race condition:

1. DNS resolution failure — At 13:01:23Z, the container tried to connect to etcd-client:2379 but DNS lookup failed: "dial tcp: lookup etcd-client: operation was canceled"
2. TCP connection timeouts — At 13:01:43Z (20 seconds later), subsequent connection attempts to the resolved IP 10.0.68.198:2379 were also canceled
3. Context deadline exceeded — At 13:01:43Z, the container gave up with: "error building REST storage: context deadline exceeded" and exited with code 1
4. Successful restart — The container restarted at 13:01:44Z and became healthy, running without further issues

The EnsureNoCrashingPods test function (in test/e2e/util/util.go) checks all pods in the hosted control plane namespace and fails if any container has restartCount > crashToleration. For the Azure platform (non-Kubevirt), defaultCrashToleration = 0, and openshift-oauth-apiserver is not in the podCrashTolerations exception map. Therefore, a single restart (restartCount=1 > 0) caused the test to fail.

This is a known pattern of transient startup races in hosted control planes where the oauth-apiserver starts before etcd DNS is fully resolvable. The dependabot changes in PR #8849 (Go version bump 1.25.7→1.25.8, AWS SDK update, KubeVirt CRD doc changes) have no relationship to etcd connectivity or oauth-apiserver startup.

Recommendations

1. Retrigger the job — This is a transient infrastructure-level startup race, not a code regression. Run /test e2e-aks to retrigger.

2. Consider adding openshift-oauth-apiserver to podCrashTolerations — Similar to the existing tolerations for ingress-operator (20 restarts), dns-operator (5 restarts), and network-node-identity (1 restart), adding a toleration of 1 restart for openshift-oauth-apiserver would prevent this known transient startup race from causing flaky test failures. The etcd DNS resolution race during HCP startup is analogous to the leader election and startup timing issues already tolerated for other components.

3. File a tracking issue — If not already tracked, consider filing a bug to investigate whether the oauth-apiserver startup can be made more resilient to etcd DNS resolution delays (e.g., longer initial backoff, readiness gate on etcd availability).

Evidence

Evidence	Detail
Failing test	TestAzureScheduler/ValidateHostedCluster/EnsureNoCrashingPods
Crashing container	openshift-oauth-apiserver in pod openshift-oauth-apiserver-66b8fdb877-vr549
Restart count	1 (toleration is 0 for Azure platform)
Crash time	2026-07-06T13:01:23Z → exited 13:01:43Z (20s runtime)
Restart time	2026-07-06T13:01:44Z (healthy after restart)
Exit code	1
Root error	error building REST storage: context deadline exceeded
Upstream cause	dial tcp: lookup etcd-client: operation was canceled (DNS), then dial tcp 10.0.68.198:2379: operation was canceled (TCP)
HCP namespace	e2e-clusters-dcd6v-azure-scheduler-rfhbf
Other EnsureNoCrashingPods results	22 PASS / 1 FAIL (only TestAzureScheduler affected)
PR changes	Dependabot dep bumps (Go 1.25.8, AWS SDK, KubeVirt CRD docs) — unrelated to failure
Test code	test/e2e/util/util.go:829 — t.Errorf("Container %s in pod %s has a restartCount > %d (%d)")
Crash toleration map	openshift-oauth-apiserver not listed in podCrashTolerations (default=0 for Azure)

---

[bryan-cox]

/retest

[bryan-cox]

/test e2e-kubevirt-aws-ovn-reduced

[bryan-cox]

/verified by e2e

[openshift-ci-robot]

@bryan-cox: This PR has been marked as verified by e2e.

Details

In response to this:

/verified by e2e

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@hypershift-jira-solve-ci: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.