Skip to content

deps(v1.5): bump the all-go-deps group with 3 updates - #365

Merged
jordigilh merged 1 commit into
release/v1.5from
dependabot/go_modules/release/v1.5/all-go-deps-3c3aaaae20
Aug 21, 2026
Merged

deps(v1.5): bump the all-go-deps group with 3 updates#365
jordigilh merged 1 commit into
release/v1.5from
dependabot/go_modules/release/v1.5/all-go-deps-3c3aaaae20

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-go-deps group with 3 updates: github.com/jordigilh/kubernaut, github.com/onsi/ginkgo/v2 and github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring.

Updates github.com/jordigilh/kubernaut from 1.5.5 to 1.5.6

Release notes

Sourced from github.com/jordigilh/kubernaut's releases.

Kubernaut v1.5.6

What's Changed

... (truncated)

Changelog

Sourced from github.com/jordigilh/kubernaut's changelog.

[1.5.6] - 2026-08-12

Security

  • Coarse-grained console-access authorization gate (#1919, #1941, AC-3/AC-6/AU-12) — Adds a new kubernaut.ai/console "use" SubjectAccessReview grant, enforced server-side at both existing AF tool-invocation paths (/mcp and /a2a/invoke), in addition to the pre-existing per-tool kubernaut.ai/tools check. Also adds an advisory GET /a2a/access pre-flight endpoint for UI clients. Operator action may be required: the chart's new apifrontend.config.rbac.consoleAccessGroups value defaults to all six built-in personas (sre, ai-orchestrator, cicd, observability, l3-audit, remediation-approver), so deployments using only those default persona group names need no changes. If you configured a custom group under apifrontend.config.rbac.personas (or renamed/replaced the defaults), you must add that same group name to apifrontend.config.rbac.consoleAccessGroups, or users in that group will have every AF tool call denied after upgrading, even though their existing per-tool grants are unchanged. helm install/helm upgrade now prints an NOTES.txt warning listing any personas group missing from consoleAccessGroups to catch this case at deploy time.
  • CVE-2026-56852 in golang.org/x/text, pulled in transitively by the db-migrate goose builder (#1763, #1781) — Pinned the dependency to the patched version in the db-migrate image's go.mod.

Fixed

  • EventBridge.EmitArtifact had no boundary-level defense against a future struct-pointer regression reintroducing #2110's gob-encoding crash (#2110, #2111 boundary-hardening follow-up) — Ported main's sanitizeArtifactData/gobProbe probe-then-fallback design to release/v1.5 (not a cherry-pick, since this branch's event_bridge.go had diverged from main's): any artifact data assigned to an SSE-bound field is now round-tripped through gob before being handed to a2a-go's deep-copy pipeline, falling back to a JSON round-trip (dropping only the offending struct pointer) instead of crashing the task if a future caller reintroduces a non-gob-registered concrete type.
  • sameKindValidationGate's retry could silently zero out a previously-validated RCA confidence, because its correction prompt read as a narrow yes/no question ("is the target correct?") (#2118) — The LLM's retry response frequently answered only that question, omitting or zeroing the separately-required confidence field and overwriting a real, already-validated value. Strengthened the correction prompt and added a deterministic confidence-backfill guard — mirroring the existing RemediationTarget.Kind guard — that restores the original confidence when the retry response omits it. A live-LLM spike against the real claude-sonnet-5 Vertex AI endpoint confirmed prompt wording alone is not reliably sufficient, making the guard the actual fix.
  • sameKindValidationGate/apiVersionValidationGate retries could silently drop the correction when the model called an undeclared tool instead of submit_result, and their retry_outcome audit field was never actually persisted (#2120, #2124) — A live-LLM spike against the real claude-sonnet-5 Vertex AI endpoint reproduced the undeclared-tool-call failure in 10/10 trials; replaying it as a synthetic tool-error result plus a reminder recovered the correct submit_result call in 10/10 trials. Both gates now retry once with that reminder. Also fixed a pre-existing bug where both gates called audit.StoreBestEffort before mutating gateEvent.Data["retry_outcome"], but production audit stores serialize Data synchronously at call time — the field was silently dropped from every persisted audit event. Both gates now defer the store call until every exit path's mutations are final.
  • kubernaut_present_decision crashed the a2a task's artifact delivery on every grounded decision, breaking the entire interactive approve/decline/dismiss flow (#2110) — The grounding guard's structured RCA substitution now assigns a plain map[string]any instead of a *tools.RCAData struct pointer, which is not gob-registered and previously failed a2a-go's deep-copy artifact fan-out.
  • aiagent_mcp_interactive_sessions_active gauge drifted upward under sustained load instead of tracking real session capacity (#2103) — Every completion path (complete, cancel, complete_no_action, workflow selection, auto-close, the session janitor) now decrements the gauge centrally inside LeaseSessionManager.Release(), instead of each caller needing its own metrics wiring.
  • kubernaut_present_decision failed JSON-schema validation when a model double-encoded the options array (#2092) — The array is now repaired back to native JSON before schema validation runs; genuinely malformed input still surfaces a real validation error.
  • kubernaut_present_decision could be called before workflow discovery ever ran, in full_remediation/full_remediation_autonomous modes (#2098) — Added an ordering guard that rejects and retries the call until kubernaut_discover_workflows has succeeded for the current investigation.
  • The AU-3 audit decision artifact emitted over SSE for kubernaut_present_decision carried the model's raw, ungrounded tool_calls_count/llm_turns values instead of the grounded ones enforceGroundingGuard backfills (#2105, #2098 regression) — ADK yields the SSE artifact from the model's raw FunctionCall before BeforeToolCallbacks (where grounding previously ran exclusively) ever execute, so the guard's mutation always arrived too late to affect what the client received. Added sanitizePresentDecisionResponse, an AfterModelCallback that sanitizes the model's FunctionCall.Args in place immediately after the model responds, before ADK streams it.
  • WatchTerminalEvents had no exit path if its event stream went silent without erroring, leaking a goroutine per affected session (#2094) — Added a 30-minute safety-net timer as an additional exit condition.
  • Interactive session capacity eroded well before interactive.maxConcurrentSessions real concurrent sessions were active, under sustained load (#2100) — Wired the previously-unused SessionJanitor into main.go, and fixed the fallback-exhausted path in session start to release its lease immediately instead of relying on a ~10-minute inactivity timeout to reclaim it.
  • workflow_discovery could hang indefinitely when KA's same-kind/API-version validation gates issued a non-streamed retry LLM call that exceeded AF's 60s inactivity budget, silently completing the investigation with an empty RCA (#2086) — KA's gate-retry calls now emit keepalive events, and AF's bridge inactivity timer resets on them.
  • Tool-call events used an inconsistent tool_name/tool wire field, breaking keepalive rendering during gate retries (#2089) — Standardized on one field name across emitters and consumers.
  • kubernaut_present_decision's schema validation rejected every call because the LLM is never instructed to compute tool_calls_count/llm_turns bookkeeping fields (#2073, #2074) — Both fields are now optional on the wire; the grounding guard backfills an authoritative value where available.
  • kubernaut_complete_no_action could fail with a race after no_matching_workflows auto-closed the same session (#2075, #2076) — Added a short-lived tombstone so a late complete_no_action call recognizes the session was already resolved instead of erroring.
  • AIAnalysis could oscillate between session regeneration and correlated-session adoption after a KA session was lost, exhausting its regeneration cap (#2080, #2081) — Session-lost handling now attempts correlated-session adoption before regenerating, and regeneration retries now use exponential backoff instead of an immediate requeue.
  • apiVersion could fail to reach KA's workflow-discovery filter, letting it silently degrade to kind-only matching and select the wrong workflow when a Kind exists in more than one API group (#2061, #2064, #2066) — Closed three independent gaps in the same pipeline: the CRD-fallback signal-context resolver now preserves TargetResource.APIVersion (#2061); AA's IncidentRequest to KA now carries resource_api_version on the wire so every investigation supplies a value, not just interactive ones (#2064); and Gateway now propagates apiVersion from Kubernetes Events and resolves/disambiguates it for Prometheus alerts via its discovery-backed registry (#2066).
  • A locally-synthesized severity-triage fallback RCA could be cached by the present-decision grounding guard as if it were an authoritative, KA-verified result (#2068) — Fallback RCAs are now explicitly marked provisional and excluded from the grounding guard's cache.
  • workflow_discovery phase could hang indefinitely after the LLM's terminal decision response, with no timeout (#1949, #1951) — Wired ai.safety.toolCallTimeout into the Investigator, cascaded session-inactivity expiry into in-flight cancellation, and wired inactivity-cancel into the interactive-session MCP handlers so a stalled terminal-decision turn can no longer wedge the phase open forever.
  • workflow_discovery still operated on stale message history after a self-correction retry (#1945, #1947) — The accumulated tool-call history is now propagated across retryWorkflowSubmit self-correction turns instead of being dropped.
  • Same-kind validation gate could accept a retry where the model's own confidence-calibration narration contradicted its submitted confidence (#1935, #1939) — Captures and replays Anthropic thinking/redacted_thinking blocks correctly across the round-trip, propagates accumulated tool-call history into gate and shadow-agent grounding review, and surfaces Reasoning.Text in the console's ThinkingPanel reasoning_delta events instead of leaving the panel empty.
  • AF interactive-investigation status messages leaked internal acronyms (KA, AA, IS CRD) to the console user (#1916, #1932) — Status messages are now phrased in user-facing language only.
  • session_active fallback artifact was missing causal_chain/tool_calls_count (#1922, #1928, #1929) — The fallback RCA card now populates both fields instead of leaving them empty when a session falls back mid-investigation.
  • Phase 2 actionability gating relied on the harness re-deriving actionability instead of trusting KA's own signal (#1918, #1925) — kubernaut_investigate's InvestigateOutput now surfaces the already-computed is_actionable/has_workflow signal, and the harness enforces the Phase 2 gate deterministically from it.
  • DD-AF-011 reinvocation gate failed open after the first investigation in a session, and plain "investigate" requests falsely reported "no workflows found" despite a catalog match (#1912, #1915, #1920) — driverActive is now cleared on session-terminal tools instead of being set-once for the life of the session, and a plain investigate request now defaults to full_remediation instead of contradicting the DD-AF-011 consent gate's own Phase-1-to-Phase-2 instruction.
  • AF's "Alert Prioritization" prompt section overrode the DD-AF-011 consent gate, launching unsolicited investigations on read-only "list alerts" queries (#1899, #1910) — Added a harness-enforced phase-transition consent guard so the LLM must explicitly declare interaction_mode before an autonomous-interactive flow can proceed.
  • kubectl_list/kubectl_get failed to resolve the GVK for valid CRD kinds present in the cluster, e.g. ACM Search (#1888, #1896) — The RESTMapper cache now self-heals on a lookup failure instead of caching the miss.
  • Interactive investigations silently hung when KA's tool-call budget was exhausted, surfacing only an opaque internal_error, and concurrent RRs could corrupt each other's budget via a pod-wide singleton AnomalyDetector (#1889, #1892, #1895) — Introduced a typed tool-budget-exhausted error and per-investigation anomaly isolation so budget exhaustion is diagnosable and concurrent investigations no longer share mutable state.
  • apifrontend's Vertex AI LLM clients ignored per-profile credentials, relying solely on ambient ADC (#1731, #1870) — NewAnthropicVertexClient and the severity-triage vertex_ai factory now honor explicit per-profile credentials.
  • AF investigate could ground against ungrounded, LLM-inferred severity instead of real cluster signal (#1839, backport tracked as #1966, merged via #1857) — Removed the ungrounded Tier-3 LLM severity-inference fallback.
  • Raw kubectl_list tool-call arguments leaked through as chat response text when alert tools were disabled (#1658, backport tracked as #1967, merged via #1836) — The raw arguments are no longer echoed back when the corresponding alert tool is unavailable.
  • Interactive session race could orphan a real RCA instead of reattaching it (#1818, backport tracked as #1968, merged via #1852) — The session now reattaches the real RCA on a race instead of leaving it orphaned; also documents the interactive_fallback vs interactive_reattached session modes for audit reconstruction.
  • vertex_ai LLM provider was hardcoded to the Anthropic model family, silently mis-routing other models (#1792, backport tracked as #1969, merged via #1824) — Now fails fast on an unrecognized model family under provider: vertex_ai instead of silently assuming Anthropic.
  • Interactive investigate could stall with zero events delivered to the client (#1811, backport tracked as #1970, merged via #1821) — Investigation events are now buffered before Subscribe to close the race window.
  • EventTypeInteractiveK8sCall was not audited for impersonated API calls (#898, backport tracked as #1971, merged via #1813) — Wired production emitters for EventTypeSessionResumed/EventTypeInteractiveK8sCall.
  • RemediationOrchestrator's ineffective-chain detection produced cross-namespace false positives (#1802, backport tracked as #1972, merged via #1810) — datastorage now scopes the remediation-history query by target resource and unifies the cluster-scoped target-resource format.
  • KA's live SSE complete event never carried RCA data (#1794, backport tracked as #1973, merged via #1800) — The complete event now carries the RCA payload.
  • BR-SESS-013 reinvocation could race the underlying a2a-go executor and fail (#1776, backport tracked as #1974, merged via #1783) — Moved the BR-SESS-013 reinvocation inside the ADK Runner to close the race.
  • Console Thinking panel was always empty due to a reasoning_delta field-name mismatch (#1771, backport tracked as #1976, merged via #1779) — Renamed the field to text to match the AF reader.
  • kubectl_get resolved the wrong plural for irregular Kind names (#1772, backport tracked as #1977, merged via #1779) — kubectl_get now uses discovery-backed RESTMapper resolution instead of a naive pluralization heuristic.
  • kubernaut_get_remediation_history always returned 400 due to a missing currentSpecHash (#1773, backport tracked as #1978, merged via #1779) — currentSpecHash is now threaded through the tool call.
  • vertexanthropic's StreamChat silently dropped extended-thinking content (#1775, backport tracked as #1979, merged via #1779) — thinking_delta content is now extracted and surfaced instead of being discarded.

... (truncated)

Commits
  • 6f96cf8 Merge pull request #2127 from jordigilh/release/v1.5.6-ga
  • db45e76 release: prepare v1.5.6 GA
  • c2b3609 Merge pull request #2125 from jordigilh/changelog/v1.5.6-backfill-rc6
  • bf42c7c docs(changelog): backfill v1.5.6 Fixed entries for rc5->rc6 (#2110,#2118,#212...
  • 5fc3fb5 Merge pull request #2122 from jordigilh/fix/2118-and-2111-port-v1.5.6
  • 2b5a879 fix(kubernautagent): recover gate retry from an undeclared LLM tool call, fix...
  • 361bbde fix(kubernautagent): backfill RCA confidence dropped by same-kind gate retry
  • 6cb0454 fix(apifrontend): port #2111 EmitArtifact gob-safety boundary hardening to re...
  • f70baeb Merge pull request #2114 from jordigilh/changelog/v1.5.6-backfill-rc5
  • 71ebdaa docs(changelog): backfill v1.5.6 Fixed entry for rc4->rc5 (#2110)
  • Additional commits viewable in compare view

Updates github.com/onsi/ginkgo/v2 from 2.32.0 to 2.32.1

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.32.1

2.32.1

Fixes

  • Defer AfterAll until repeated spec completes [e647b3b]
Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.32.1

Fixes

  • Defer AfterAll until repeated spec completes [e647b3b]
Commits

Updates github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring from 0.93.0 to 0.93.1

Release notes

Sourced from github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring's releases.

0.93.1 / 2026-08-10

  • [BUGFIX] Fix duplicate kubelet targets for nodes reporting several addresses of the same IP family. #8739
  • [BUGFIX] Fix argument list for Thanos containers when custom TLS ciphers or curves are specified. #8749
Changelog

Sourced from github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring's changelog.

0.93.1 / 2026-08-10

  • [BUGFIX] Fix duplicate kubelet targets for nodes reporting several addresses of the same IP family. #8739
  • [BUGFIX] Fix argument list for Thanos containers when custom TLS ciphers or curves are specified. #8749
Commits
  • 51cc33a Merge pull request #8750 from simonpasquier/cut-0.93.1
  • 709d143 chore: cut v0.93.1
  • b547616 Merge pull request #8749 from jan--f/fix/thanos-grpc-tls-repeated-flags
  • a1f22de fix: emit repeated flags for Thanos gRPC TLS ciphers and curves
  • d8beacd Merge pull request #8739 from sophotechlabs/fix/kubelet-endpoints-ip-family
  • 964a482 kubelet: keep a single Endpoints address per node
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(v1.5): bump the all-go-deps group with 3 updates
5bef80a 
Bumps the all-go-deps group with 3 updates: [github.com/jordigilh/kubernaut](https://github.com/jordigilh/kubernaut), [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) and [github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring](https://github.com/prometheus-operator/prometheus-operator).


Updates `github.com/jordigilh/kubernaut` from 1.5.5 to 1.5.6
- [Release notes](https://github.com/jordigilh/kubernaut/releases)
- [Changelog](https://github.com/jordigilh/kubernaut/blob/v1.5.6/CHANGELOG.md)
- [Commits](jordigilh/kubernaut@v1.5.5...v1.5.6)

Updates `github.com/onsi/ginkgo/v2` from 2.32.0 to 2.32.1
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.32.0...v2.32.1)

Updates `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` from 0.93.0 to 0.93.1
- [Release notes](https://github.com/prometheus-operator/prometheus-operator/releases)
- [Changelog](https://github.com/prometheus-operator/prometheus-operator/blob/main/CHANGELOG.md)
- [Commits](prometheus-operator/prometheus-operator@v0.93.0...v0.93.1)

---
updated-dependencies:
- dependency-name: github.com/jordigilh/kubernaut
  dependency-version: 1.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-deps
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.32.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-deps
- dependency-name: github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
  dependency-version: 0.93.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates (Dependabot) security Security-related updates labels Aug 17, 2026
@dependabot
dependabot Bot requested a review from jordigilh as a code owner August 17, 2026 07:55
@dependabot dependabot Bot added dependencies Dependency updates (Dependabot) security Security-related updates labels Aug 17, 2026
@jordigilh
jordigilh merged commit e5c68f5 into release/v1.5 Aug 21, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/release/v1.5/all-go-deps-3c3aaaae20 branch August 21, 2026 03:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jordigilh jordigilh jordigilh approved these changes

Assignees

No one assigned

Labels

dependencies Dependency updates (Dependabot) security Security-related updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jordigilh