Dep bump 2026 07 09

[vivekpatani]

No description provided.

[kubernetes-prow]

Hi @vivekpatani. Thanks for your PR.

I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ahrtr]

/ok-to-test

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.92%. Comparing base (3bc83ee) to head (3de6b5c).

Additional details and impacted files

see 30 files with indirect coverage changes

@@            Coverage Diff             @@
##             main   #22093      +/-   ##
==========================================
+ Coverage   69.69%   69.92%   +0.22%     
==========================================
  Files         449      449              
  Lines       38177    38177              
==========================================
+ Hits        26609    26694      +85     
+ Misses      10134    10069      -65     
+ Partials     1434     1414      -20     

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3bc83ee...3de6b5c. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ahrtr]

/retest

[ahrtr]

/retest

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ahrtr, vivekpatani

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ahrtr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubernetes-prow]

@vivekpatani: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-etcd-coverage-report	3de6b5c	link	true	/test pull-etcd-coverage-report

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[ivanvc]

We usually don't bump indirect dependencies unless there's a vulnerability reported. Unless I'm mistaken, go-sqlite3 is indirect: 9133a02. But we still bumped it 🤔

For next week, we should also bump the following three: #22036, #22056, and #22068.

[ahrtr]

We usually don't bump indirect dependencies unless there's a vulnerability reported. Unless I'm mistaken, go-sqlite3 is indirect: 9133a02. But we still bumped it 🤔

Right, theoretically it's correct. In practice, I think it should be OK as long as the workflows are green.

• We still need to follow the dependency guidance as much as we can. thx for the reminder anyway.
• We don't have much active reviewers taking care of such routine work.

For next week, we should also bump the following three: #22036, #22056, and #22068.

Let's do not wait next week. @vivekpatani do you have bandwidth to take care of it this week? thx

[vivekpatani]

Will pick it up. No stress. Thanks.

[ivanvc]

Maybe we should drop indirect dependency bumps from Dependabot. If there's a security patch, Dependabot will bump it on its own. It's configured through Dependabot's security settings. So, I think the easiest would be to drop indirect deps. WDYT, @ahrtr?

[ahrtr]

Maybe we should drop indirect dependency bumps from Dependabot.

Sounds good, pls feel free to deliver a PR, thx