fix(deps): update all minor and patch by renovate[bot] · Pull Request #393 · crossplane-contrib/provider-gitlab

renovate · 2026-07-14T05:56:35Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout	action	patch	`v7.0.0` → `v7.0.1`
docker/login-action	action	minor	`v4.4.0` → `v4.6.0`
fkirc/skip-duplicate-actions	action	patch	`v5.3.1` → `v5.3.2`
github.com/crossplane/crossplane-tools	require	digest	`dd45172` → `659f1dc`
github.com/crossplane/crossplane/apis/v2	require	patch	`v2.3.3` → `v2.3.4`
github.com/go-logr/logr	require	patch	`v1.4.3` → `v1.4.4`
gitlab.com/gitlab-org/api/client-go/v2	require	minor	`v2.47.0` → `v2.53.0`	`v2.54.0`
k8s.io/api	require	patch	`v0.36.2` → `v0.36.3`
k8s.io/apiextensions-apiserver	require	patch	`v0.36.2` → `v0.36.3`
k8s.io/apimachinery	require	patch	`v0.36.2` → `v0.36.3`
k8s.io/client-go	require	patch	`v0.36.2` → `v0.36.3`

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

docker/login-action (docker/login-action)

fkirc/skip-duplicate-actions (fkirc/skip-duplicate-actions)

`v5.3.2`

Compare Source

v5.3.2

crossplane/crossplane (github.com/crossplane/crossplane/apis/v2)

`v2.3.4`

Compare Source

v2.3.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

Fixed repeated owner updates for composed Usages (#7597, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
crossplane render fixes (#7599, originally #7544): render no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render.
Vulnerability-scannable images (#7574): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.
Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#7618, #7614, #7615) and the sigstore stack — cosign (#7559), rekor (#7560), timestamp-authority (#7570), sigstore-go (#7583) — to pick up upstream CVE fixes. See ## What's Changed for the full list.

What's Changed

chore(deps): update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.3) by @crossplane-renovate[bot] in #7560
chore(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.3) by @crossplane-renovate[bot] in #7559
chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.3) by @crossplane-renovate[bot] in #7570
[Backport release-2.3] build(nix): build with buildGoModule so images are vulnerability-scannable by @phisco in #7574
chore(deps): update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.3) by @crossplane-renovate[bot] in #7583
fix(deps): combined security bumps (grpc, x/net, x/text) (release-2.3) by @lsviben in #7618
[Backport release-2.3] fix: avoid repeated owner updates for composed Usages by @github-actions[bot] in #7597
[Backport release-2.3] render: Don't overwrite the input XR's UID if it has one and validate observed resources by @github-actions[bot] in #7599
chore(deps): update module golang.org/x/text to v0.39.0 [security] (release-2.3) by @crossplane-renovate[bot] in #7615
chore(deps): update module golang.org/x/net to v0.56.0 [security] (release-2.3) by @crossplane-renovate[bot] in #7614

Full Changelog: crossplane/crossplane@v2.3.3...v2.3.4

go-logr/logr (github.com/go-logr/logr)

`v1.4.4`

Compare Source

What's Changed

drop +build tags by @pohly in #401
CI: avoid floating dependencies, fix issues by @pohly in #432
Bump to Go 1.26 by @thockin in #445
funcr: bound slog.Group nesting depth to prevent stack overflow by @martinholovsky in #447
funcr: Handle and test recursive values by @thockin in #446

New Contributors

@martinholovsky made their first contribution in #447

Full Changelog: go-logr/logr@v1.4.3...v1.4.4

gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go/v2)

`v2.53.0`

Compare Source

2.53.0

🚀 Features

feat: support project api 'cicd_catalog_enabled' field (!2963) by BoxBoxJason

2.53.0 (2026-07-28)

Features

support project api 'cicd_catalog_enabled' field (894a927)

`v2.52.0`

Compare Source

2.52.0 🚀 Features

Add custom attributes filtering for groups (!2959) by Giannis Kepas

🔄 Other Changes

chore(deps): update docker docker tag to v29.6.2 (!2960) by GitLab Dependency Bot

2.52.0 (2026-07-27)

`v2.51.0`

Compare Source

2.51.0 🚀 Features

feat(client): add option to retry only idempotent requests (!2945) by Patrick Dawkins

🔄 Other Changes

feat(workitems): Add Children field to WorkItem struct. (!2950) by Florian Forster

2.51.0 (2026-07-17)

Features

client: add option to retry only idempotent requests (8260b22)
workitems: Add Children field to WorkItem struct. (6a5eca2)

`v2.50.0`

Compare Source

2.50.0

🚀 Features

Add mr_default_title_template to projects (!2958) by Giannis Kepas

🔄 Other Changes

chore(deps): update module github.com/google/cel-go to v0.29.2 (!2957) by GitLab Dependency Bot

2.50.0 (2026-07-16)

`v2.49.0`

Compare Source

2.49.0

🚀 Features

Update ListWorkItems to return only CE fields by default. ListWorkItemOptions now includes ReturnedFields which allows users to opt in to EE fields (!2936) by Kai Armstrong

🔄 Other Changes

chore(deps): update module github.com/google/cel-go to v0.29.2 (!2956) by GitLab Dependency Bot
Pin Duo agent image to 0.0.10 for Duo executions during library development (!2952) by Patrick Rice

2.49.0 (2026-07-15)

`v2.48.1`

Compare Source

2.48.1 🐛 Bug Fixes

fix(audit_events): Add support for object-valued details.change (stored in details.ChangeObject) and the details.changes array (!2949) by Cesar Hinojosa

2.48.1 (2026-07-14)

Bug Fixes

audit_events: Add support for object-valued details.change (stored in details.ChangeObject) and the details.changes array (7f7f38f)

`v2.48.0`

Compare Source

2.48.0 🚀 Features

TCC-14338 Add NonArchived field to ListMergeRequestsOptions (!2944) by Federico Mannucci

🔄 Other Changes

Add new skill for providing additional instructions to the quick win agent (!2951) by Patrick Rice

2.48.0 (2026-07-13)

kubernetes/api (k8s.io/api)

`v0.36.3`

Compare Source

kubernetes/apiextensions-apiserver (k8s.io/apiextensions-apiserver)

`v0.36.3`

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

`v0.36.3`

Compare Source

kubernetes/client-go (k8s.io/client-go)

`v0.36.3`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-24T02:37:56Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

9 additional dependencies were updated

Details:

Package	Change
`sigs.k8s.io/structured-merge-diff/v6`	`v6.3.2` -> `v6.3.3`
`golang.org/x/mod`	`v0.36.0` -> `v0.37.0`
`golang.org/x/net`	`v0.55.0` -> `v0.56.0`
`golang.org/x/sys`	`v0.45.0` -> `v0.46.0`
`golang.org/x/term`	`v0.43.0` -> `v0.44.0`
`golang.org/x/text`	`v0.38.0` -> `v0.39.0`
`golang.org/x/tools`	`v0.45.0` -> `v0.47.0`
`k8s.io/code-generator`	`v0.36.2` -> `v0.36.3`
`k8s.io/component-base`	`v0.36.2` -> `v0.36.3`

renovate Bot force-pushed the renovate/all-minor-and-patch branch from e1c7252 to 96d2a43 Compare July 14, 2026 17:11

renovate Bot changed the title ~~chore(deps): update github.com/floric/crossplane-tools digest to dd45172~~ chore(deps): update all minor and patch Jul 14, 2026

renovate Bot force-pushed the renovate/all-minor-and-patch branch from 96d2a43 to 576c971 Compare July 14, 2026 23:11

renovate Bot changed the title ~~chore(deps): update all minor and patch~~ fix(deps): update all minor and patch Jul 14, 2026

renovate Bot force-pushed the renovate/all-minor-and-patch branch 7 times, most recently from 7448fac to 18d722a Compare July 21, 2026 19:11

renovate Bot force-pushed the renovate/all-minor-and-patch branch 2 times, most recently from c93591f to 6b449c7 Compare July 24, 2026 02:37

renovate Bot force-pushed the renovate/all-minor-and-patch branch 7 times, most recently from cf0c255 to 5575914 Compare July 30, 2026 13:07

fix(deps): update all minor and patch

2477bb4

renovate Bot force-pushed the renovate/all-minor-and-patch branch from 5575914 to 2477bb4 Compare July 30, 2026 19:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update all minor and patch - #393

fix(deps): update all minor and patch#393
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-and-patch

renovate Bot commented Jul 14, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

🎉 Highlights

What's Changed

What's Changed

New Contributors

2.53.0

🚀 Features

2.53.0 (2026-07-28)

Features

2.52.0

🚀 Features

🔄 Other Changes

2.52.0 (2026-07-27)

2.51.0

🚀 Features

🔄 Other Changes

2.51.0 (2026-07-17)

Features

2.50.0

🚀 Features

🔄 Other Changes

2.50.0 (2026-07-16)

2.49.0

🚀 Features

🔄 Other Changes

2.49.0 (2026-07-15)

2.48.1

🐛 Bug Fixes

2.48.1 (2026-07-14)

Bug Fixes

2.48.0

🚀 Features

🔄 Other Changes

2.48.0 (2026-07-13)

Configuration

Uh oh!

renovate Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 14, 2026 •

edited

Loading

renovate Bot commented Jul 24, 2026 •

edited

Loading