[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/quic-go/quic-go	v0.63.0 → v0.64.1			require	minor
github.com/vishvananda/netlink	3fdd742 → e536899			require	digest
go.datum.net/compute	v0.12.11 → v0.14.1			require	minor
go.datum.net/network-services-operator	v0.32.31 → v0.34.1			require	minor
go.miloapis.com/ipam	v0.5.1 → v0.5.5			require	patch
golang.org/x/crypto/x509roots/fallback	9f2b28d → 1da6254			require	digest
golang.org/x/net	v0.61.0 → v0.62.0			require	minor
golang.org/x/tools	v0.51.0 → v0.52.0			require	minor
google.golang.org/genproto/googleapis/rpc	ce908d2 → 2ffab32			require	digest
google.golang.org/grpc	v1.84.0 → v1.85.0			require	minor
k8s.io/cri-api	v0.37.1 → v0.37.2			require	patch
k8s.io/utils	cf1189d → ca04ba5			require	digest

---

Release Notes

quic-go/quic-go (github.com/quic-go/quic-go)

v0.64.1

Compare Source

This patch release fixes datagram receive cancellation and stream reset handling.

Notable Fixes

• Conn.ReceiveDatagram now fails immediately if the context is already canceled: #​5947
• http3: Stream.ReceiveDatagram and RequestStream.ReceiveDatagram now fail immediately if the context is already canceled: #​5948
• Stream reset handling now ignores reliable boundary updates after cancellation: #​5950

Changelog

• ignore reliable boundary updates after stream cancellation by @​marten-seemann in #​5950
• fail Conn.ReceiveDatagram if the context is already canceled by @​marten-seemann in #​5947
• http3: fail Stream.ReceiveDatagram if the context is already canceled by @​marten-seemann in #​5948

Full Changelog: quic-go/quic-go@v0.64.0...v0.64.1

v0.64.0

Compare Source

This release improves congestion control and performance, especially on paths with packet reordering:

• Slow-start pacing now uses twice the estimated bandwidth, allowing the sending rate to double each RTT: #​5882
• Application-data loss detection now disables packet-threshold detection after a spurious loss, avoiding repeated unnecessary retransmissions caused by packet reordering: #​5905
• Application-data loss detection now uses an adaptive time threshold that increases after spurious losses, allowing more time for reordered packets to arrive: #​5925
• The congestion controller now restores its congestion window and recovery state after a reduction caused entirely by spurious packet loss: #​5923

Notable Fixes

• Congestion recovery now respects send order across Initial, Handshake and application-data packets, fixing incorrect recovery decisions caused by comparing packet numbers from different spaces: #​5920
• Connections now fall back to 1200-byte Initial packets on EMSGSIZE when Config.InitialPacketSize is unset, allowing handshakes over paths with smaller MTUs: #​5911
• Oversized packets are now rejected before serialization, including Initial packets with excessively large address-validation tokens: #​5937
• Path MTU discovery now restarts correctly after connection migration and NAT rebinding: #​5887
• Servers now retry unanswered PATH_CHALLENGEs with exponential backoff as more packets arrive on the candidate path, preventing path validation from stalling when a challenge is acknowledged but no PATH_RESPONSE arrives: #​5930
• Servers now continue responding to PATH_CHALLENGEs on existing candidate paths when the candidate path limit is reached: #​5929
• Writes after closing a SendStream or Stream now return quic.ErrStreamClosed, which is also used as the stream context's cancellation cause: #​5885
• Conn.SendDatagram now returns the connection's close error after shutdown, instead of accepting datagrams that will be silently dropped: #​5880
• http3: SendDatagram now immediately returns an error after the stream's send side closes, including after STOP_SENDING or connection shutdown: #​5884
• http3: request header, response header and trailer buffers now grow as data arrives, avoiding large allocations based solely on a peer's advertised HEADERS frame length: #​5886
• Spurious losses are now detected when an ACK only acknowledges packets previously declared lost: #​5895
• Spurious losses are now detected when ACKs arrive out of order: #​5900
• Path migration now clears the old path's loss history, preventing stale spurious-loss reports and recovery adjustments: #​5903
• MTU and path probes no longer trigger spurious-loss reports or adaptive loss-recovery changes: #​5906

Notable Changes

• ConnectionStats now exposes CongestionWindow, reporting the local sender's congestion window on the active network path in bytes: #​5901
• http3.Stream and http3.RequestStream now expose QlogTrace, allowing applications to add events to the underlying connection's qlog trace: #​5935
• http3/qlog.RedactHeaders allows applications to redact HTTP/3 header and trailer values, including pseudo-headers, before they are written to qlog: #​5932
• qlog: locally dropped QUIC datagrams are now recorded with quic:datagram_dropped, including drops caused by a full receive buffer or an oversized outgoing datagram: #​5907
• qlog: quic:recovery_parameters_set now records initial recovery parameters and changes to loss-detection thresholds, including resets after path migration: #​5926

Changelog

• return an error from Conn.SendDatagram when the connection is closed by @​marten-seemann in #​5880
• http3: fail SendDatagram as soon as the send side is closed by @​marten-seemann in #​5884
• use ErrStreamClosed instead of context.Canceled for closed streams by @​marten-seemann in #​5885
• congestion: pass the pacing rate explicitly to the pacer by @​marten-seemann in #​5881
• congestion: increase slow start pacing factor to 2 by @​marten-seemann in #​5882
• http3: grow header block buffers as data arrives by @​marten-seemann in #​5886
• ackhandler: use a fixed cap for tracked lost packets by @​marten-seemann in #​5888
• ackhandler: detect spurious loss when only lost packets are ACKed by @​marten-seemann in #​5895
• ackhandler: avoid floating point math for time threshold calculations by @​marten-seemann in #​5896
• ackhandler: move MaxAckDelay constant from the protocol package by @​marten-seemann in #​5892
• ackhandler: don’t store MaxAckDelay on the appDataReceivedPacketTracker by @​marten-seemann in #​5893
• congestion: move MinPacingDelay constant from the protocol package by @​marten-seemann in #​5889
• handshake: move the KeyUpdateInterval from the protocol package by @​marten-seemann in #​5891
• ackhandler: detect spurious losses in reordered ACKs by @​marten-seemann in #​5900
• move 0-RTT queue constants from the protocol package by @​marten-seemann in #​5890
• remove the fixed size cap on post-handshake CRYPTO frames by @​marten-seemann in #​5902
• ackhandler: clear lost packet history on path migration by @​marten-seemann in #​5903
• ackhandler: move packet number skipping consts from the protocol package by @​marten-seemann in #​5904
• expose the sender's congestion window in ConnectionStats by @​marten-seemann in #​5901
• ackhandler: disable packet-threshold loss detection on spurious losses by @​marten-seemann in #​5905
• ackhandler: exclude MTU and path probes from lost packet tracking by @​marten-seemann in #​5906
• fix MTU probing after path changes by @​marten-seemann in #​5887
• qlog locally dropped QUIC datagrams by @​marten-seemann in #​5907
• ci: bump CodSpeedHQ/action from 5.2.1 to 5.4.0 by @​dependabot[bot] in #​5912
• ci: update golangci-lint to v2.14.0 by @​marten-seemann in #​5919
• utils: use uint32 for random number generation by @​marten-seemann in #​5916
• ackhandler: use a uint32 countdown for packet number skipping by @​marten-seemann in #​5917
• introduce a dedicated type for packet number spaces by @​marten-seemann in #​5921
• use packet numbers from a single packet number space by @​marten-seemann in #​5920
• restore congestion control state after spurious packet loss by @​marten-seemann in #​5923
• ackhandler: increase the time threshold after spurious losses by @​marten-seemann in #​5925
• fall back to 1200 bytes initial packet size on EMSGSIZE by @​marten-seemann in #​5911
• qlog initial recovery parameters and loss threshold updates by @​marten-seemann in #​5926
• README: link OSS-Fuzz badge to the introspector by @​marten-seemann in #​5928
• http3/qlog: implement redacting of header fields by @​marten-seemann in #​5932
• http3: expose the connection's qlog trace on streams by @​marten-seemann in #​5935
• reject oversized packets before serialization by @​marten-seemann in #​5937
• only enforce the candidate path limit for new paths by @​marten-seemann in #​5929
• retry server path challenges with exponential backoff by @​marten-seemann in #​5930

Full Changelog: quic-go/quic-go@v0.63.0...v0.64.0

datum-cloud/compute (go.datum.net/compute)

v0.14.1

Compare Source

Upgrading compute no longer recreates running instances whose workload is unchanged.

What's new

• Instances keep running across upgrades. v0.14.0 recreated every instance that mounts a ConfigMap or Secret volume because the Kubernetes 0.37 libraries changed how its template hashed. The template hash now ignores unset fields, and instances carrying the older hash count as current and have it rewritten in place. (#​561)

[!NOTE]
No schema changes. Existing resources keep working without any conversion. Upgrading from v0.14.0 recreates no instances; staging upgraded from the same libraries with no instance recreated. An instance still carrying a v0.13.3 hash is recreated once.

Changelog

• 5d871cf Merge pull request #​561 from datum-cloud/fix/560-stable-template-hash
• 5cd41d4 fix: Continue the reconcile when a hash rewrite fails
• 74a1dde fix: Keep instances running across library upgrades

v0.14.0

Compare Source

Instance names move to their own DNS scope, staging compute usage is priced from standalone pricings, and the cell capacity alerts can fire again.

What's new

• Instance names publish under the instances scope. An instance named web-01 now publishes as web-01.instances.<zone>, so names from different kinds and providers never collide. Only applies where InternalDNSPublishing is enabled. (#​547)
• Staging compute usage is priced with ServicePricings. vCPU and memory prices move from the ServiceConfiguration to standalone pricing manifests at the same rates. (#​548)
• The instance overview focuses on the instance. The page shows the instance's addresses and private DNS names in place of placeholder metric tiles. (#​554)
• Capacity alerts can fire again. cell:compute_hosts_ready:count recorded only once, so ComputeCellNoHostReady and ComputeCellHostsUnavailable never fired. (#​549)
• Infrastructure pods report resource metrics. kubectl top works for infrastructure pods such as the private DNS fleet. (#​552)
• Kubernetes 0.37 libraries. (#​546)

[!NOTE]
The CRD changes are additive only, from the Kubernetes 0.37 libraries. Existing resources keep working without any conversion.

Changelog

• cc5f792 Merge pull request #​545 from datum-cloud/renovate/datum-cloud-actions-1.x
• fe23efd Merge pull request #​546 from datum-cloud/chore/k8s-0.37
• 4f032ed Merge pull request #​547 from datum-cloud/feat/instances-dns-scope
• ead650e Merge pull request #​548 from datum-cloud/claude/standalone-service-pricing-452530
• 8980bf5 Merge pull request #​549 from datum-cloud/fix/tighten-capacity-rules
• 25cc285 Merge pull request #​552 from datum-cloud/codex/resource-metrics-container-fallback
• 1f35b4b Merge pull request #​554 from datum-cloud/claude/instance-overview-networking
• 461304f chore(deps): update datum-cloud/actions action to v1.22.0
• b509694 feat: Focus the instance overview on the instance
• ecec9ba feat: Price staging compute usage with ServicePricings
• cf55e4d feat: Publish instance names under the instances scope
• 2e1279e feat: Read instance addresses and private DNS names
• 6499fb2 fix: Drop the card around the metrics KPI row
• 83f0cb3 fix: Recreate a registration when its name changes
• e238a07 fix: Report Ready only for the current registration
• 2bb2686 fix: expose infrastructure pod resource metrics
• 4bd73cf fix: tighten capacity alert rules

v0.13.3

Compare Source

What's Changed

• fix: Drop the docker/docker module for its advisories by @​ecv in #​544

Full Changelog: datum-cloud/compute@v0.13.2...v0.13.3

Changelog

• dfb74d5 Merge pull request #​544 from datum-cloud/fix/docker-advisories
• 5084533 fix: Drop the docker/docker module for its advisories

v0.13.2

Compare Source

What's Changed

• chore(deps): update module github.com/containerd/containerd/v2 to v2.2.9 [security] by @​renovate[bot] in #​374

Full Changelog: datum-cloud/compute@v0.13.1...v0.13.2

Changelog

• a747469 Merge pull request #​374 from datum-cloud/renovate/go-github.com-containerd-containerd-v2-vulnerability
• a4d43ef chore(deps): update module github.com/containerd/containerd/v2 to v2.2.9 [security]

v0.13.1

Compare Source

Instance shell

• When a shell session ends, its background cleanup now stops within seconds instead of lingering for several minutes, and its leftover files are cleaned up (#​542).

Command line

• datumctl compute exec no longer turns Compute on for a project. If the project doesn't have Compute, it stops with a clear message naming the project and the environment you're signed in to, so a typo or the wrong sign-in is easy to spot (#​543).

Full changelog: datum-cloud/compute@v0.13.0...v0.13.1

Changelog

• b329e92 Merge pull request #​542 from datum-cloud/claude/project-thread-nb1ecz
• 8901213 Merge pull request #​543 from datum-cloud/claude/project-thread-21vepa
• d59ec27 fix: Stop shell exit watch once its session ends
• 4657934 fix: satisfy goconst in activation gate
• 175a839 fix: stop compute exec from turning on compute

v0.13.0

Compare Source

Instance shell

• Each shell session now shows up once in your activity log when it starts and once when it ends. Before, a session could be logged twice (#​522).
• Ending many shell sessions on one instance no longer slows down the rest of the location (#​523).
• Shell sessions can now clean up every process they started when you disconnect. This turns on location by location as instances pick up the cleanup helper. Until then, shells keep working as before (#​496, #​537).
• Shell activity now shows when an AI assistant opened a session on your behalf (#​514, #​516).

AI assistant

• The assistant can suggest commands to run on your instance, and run one-off commands after you approve them (#​506, #​508).

Instances

• An instance now reports that it isn't ready when it crashes or loses its network connection, instead of looking healthy (#​527, #​528).
• Updating a crashing instance's settings replaces it, instead of leaving it stuck (#​527).
• Scaled-down instances no longer linger in your project (#​457).
• New projects can create instances sooner after compute is turned on (#​520, #​535, #​538).

Command line

• Redeploying with datumctl no longer publishes a public URL unless you ask for one (#​494).

Full changelog: datum-cloud/compute@v0.12.13...v0.13.0

Changelog

• 90471e0 Add approval-gated assistant instance exec path
• aacfe94 Add per-session child reaper for instance shells
• ded8e3a Add verified instance command suggestions for assistant
• fc8f8b4 Align instance DNS publishing with VPC resolver contexts
• 36be0ec Allow verified assistant proof on console sessions
• 14c73bb Deduplicate exec test requester token
• de54496 Discover internal DNS project identities through Milo
• c455a8b Fix assistant command suggestion lint findings
• 74b6634 Fix shell reaper lint failures
• 93bfa17 Format assistant activity policy test
• 6a644c0 Keep internal DNS publication behavior behind its feature gate
• 4acb3f7 Merge branch 'main' into codex/shell-session-reaper
• efa6afe Merge branch 'main' into enhancement/agent-sandboxes
• 1c353ad Merge branch 'main' into fix/deploy-no-implicit-publish
• 8a1578c Merge main into projected instance scale-down fix
• 28813e1 Merge pull request #​197 from datum-cloud/doc/rfc-compute-load-autoscaling
• d1f1cac Merge pull request #​451 from datum-cloud/feat/internal-dns-instance-publishing
• a3a1c61 Merge pull request #​457 from datum-cloud/codex/fix-projected-instance-scale-down
• a672c0b Merge pull request #​494 from datum-cloud/fix/deploy-no-implicit-publish
• 34b2d99 Merge pull request #​496 from datum-cloud/codex/shell-session-reaper
• dca8ce5 Merge pull request #​506 from datum-cloud/codex/assistant-exec-suggestions
• 451c263 Merge pull request #​508 from datum-cloud/codex/assistant-exec-run
• 6ecfc66 Merge pull request #​510 from datum-cloud/codex/raise-e2e-inotify-limit
• 7f29208 Merge pull request #​514 from datum-cloud/codex/allow-signed-assistant-session-proof
• 9785ecd Merge pull request #​515 from datum-cloud/feat/demo-reuse-network
• 9205ec1 Merge pull request #​516 from datum-cloud/codex/assistant-shell-activity-attribution
• c021eac Merge pull request #​518 from datum-cloud/fix/internal-dns-interface-addresses
• 8933eaf Merge pull request #​519 from datum-cloud/fix/internal-dns-unconfigured-location
• 40301ef Merge pull request #​520 from datum-cloud/fix/projector-requeue-unengaged-project
• d8c5928 Merge pull request #​522 from datum-cloud/claude/project-thread-rfjtmj
• 2d8d049 Merge pull request #​523 from datum-cloud/claude/project-thread-kftaoh
• 14e200f Merge pull request #​527 from datum-cloud/claude/instance-runtime-ready
• 6dc58b3 Merge pull request #​528 from datum-cloud/claude/instance-interface-health
• 57a9854 Merge pull request #​530 from datum-cloud/claude/projection-stale-resourceversion
• 6c9cb14 Merge pull request #​531 from datum-cloud/claude/internal-dns-follow-instance-ready
• cffa011 Merge pull request #​533 from datum-cloud/claude/project-thread-0v9m0c
• 3bd5b76 Merge pull request #​534 from datum-cloud/claude/project-thread-mhuvjc
• e1d5780 Merge pull request #​535 from datum-cloud/claude/project-thread-31fuhn
• 0758c35 Merge pull request #​537 from datum-cloud/claude/project-thread-wowrhp
• 19f1b2b Merge pull request #​538 from datum-cloud/claude/project-thread-31fuhn
• 43d4733 Merge pull request #​81 from datum-cloud/enhancement/agent-sandboxes
• 9facbf7 Merge remote-tracking branch 'origin/main' into claude/instance-interface-health
• 7030047 Merge remote-tracking branch 'origin/main' into claude/project-thread-0v9m0c
• b9ced1e Merge remote-tracking branch 'origin/main' into codex/internal-dns-sync21-451
• afc1cf9 Name the project discovery test fixture
• 850ca82 Publish instance names using the allocated DNS namespace
• c23f29d Raise inotify instance quota for Kind E2E runner
• ade5d45 Scope runtime observations to the instance slot
• 1f22c9b Share DNS name conflict reason across publication status
• dac1156 Share DNS protocol constants for CI lint checks
• 73f8f79 Show verified assistant origin in shell activity
• 8439857 Stage opt-in assistant exec capability and fix CI lint
• 01165bd api: identify instance DNS status by network reference
• e2a1a7c ci: allow Compute candidate qualification
• e44ada8 ci: raise watcher limits for Karmada tests
• 63078e9 doc: HPA-based compute autoscaling RFC
• a95e06f doc: add an initial compute autoscaling RFC
• 73ffe79 feat(ui): Join the project's network when deploying the demo
• 47c7d49 feat(ui): Show an empty Workloads column as one row
• d488856 feat: Count shell sweep work and activity events
• 17e83ca feat: Count the shell exit watch with other execs
• 330826e feat: Publish DNS addresses and health together
• 9730105 feat: Publish private DNS names for compute instances
• a3aa115 feat: Show limits, events and sweep on shell dashboard
• 8f1daad feat: create network interface claims for Pods
• 673a452 fix(cli): stop a redeploy publishing a URL nobody asked for
• ea559cb fix: Bound the shell sweep to sessions the cell knows
• 3083aea fix: Check shell session markers in bounded batches
• 336db66 fix: Classify NetworkInterfaceNotProgrammed for the agent
• 7c8f8e0 fix: Classify the runtime readiness reasons for the agent
• f954db0 fix: Drop the extra blank line from the shell dashboard
• de778e6 fix: Hold Ready through a short interface withdrawal
• d04d0a3 fix: Keep shells working on instances without the reaper
• 84ddfa6 fix: Keep stale resourceVersion off new projections
• bafcc7e fix: Mark a recorded shell event even if the session moved
• 05e3e27 fix: Patch only interface availability status
• 8797cb5 fix: Preserve DNS records when interface programming health is unknown
• 0327f40 fix: Preserve DNS through observation outages
• 6ebf0ae fix: Preserve read-only interface DNS status
• dcb0f1d fix: Publish DNS registrations using zone names
• 008ba7f fix: Publish internal DNS from interface allocations
• 0ae7bef fix: Publish private DNS from Instance status alone
• fcf3a4e fix: Read publication zone references consistently
• 0430ffa fix: Replace a crashing instance when its template changes
• 6f5fe02 fix: Report unconfigured internal DNS locations without retrying
• e957824 fix: Resolve internal DNS publisher lint findings
• 9e26c5e fix: Retry instance projection until the project cluster engages
• 1772a91 fix: Withdraw Ready from an instance whose runtime crashes
• 8b00d50 fix: Withdraw Ready when an instance's interface is withdrawn
• 5de85fe fix: admit instance types before the project is engaged
• 9d04a84 fix: finalize projected instances before cell deletion
• c369e8a fix: publish observed private runtime addresses
• 91447f3 fix: register project API for DNS publishing
• 2068999 fix: release a finished holder's claim before matching
• 0abe781 fix: release claims of finished Pods and report waits
• 271680c fix: remove stale projected instances after scale down
• 334cc2e fix: satisfy lint in Pod network interface code
• 05c0d7e fix: share the DNS readiness condition name
• db0a0ed fix: wrap internal DNS feature help
• b7df134 refactor: Publish instance DNS through project RBAC
• 9586fdc refactor: Read DNS reference names directly
• babb5fa refactor: Read interface programming from the claim
• 071d9b9 refactor: Remove unused DNS expiry clock
• d033e85 refactor: Return only an error from the projector's inner reconcile
• 4a5697c refactor: Share DNS observation field names
• 8cfe258 refactor: Share DNS record field name
• f637cd6 test(e2e): allow other instance finalizers
• a0da36d test(e2e): cover projected instance scale-down ordering
• 76b368c test(e2e): seed blocked replica for projection cleanup

v0.12.13

Compare Source

What's Changed

• feat(service-catalog): Retire the unused instance meters by @​JoseSzycho in #​503

Full Changelog: datum-cloud/compute@v0.12.12...v0.12.13

Changelog

• b25bf63 Merge pull request #​503 from datum-cloud/feat/retire-unused-meters
• 2f3fbd4 feat(service-catalog): Retire the unused instance meters

v0.12.12

Compare Source

What's Changed

• Stop replica defaulting loop from blocking suspension propagation by @​scotwells in #​499
• feat(service-catalog): Deprecate unused meters and convert priced usage by @​JoseSzycho in #​486
• Add optional TTL to compute exec sessions by @​scotwells in #​497
• feat(o11y): record compute host capacity by @​savme in #​502

Full Changelog: datum-cloud/compute@v0.12.11...v0.12.12

Changelog

• b3a550e Add optional TTL to compute exec sessions
• a936235 Default downstream replica target before Karmada propagation
• 856de87 Fix TTL CLI test lint
• 0fa538c Merge branch 'codex/fix-suspension-propagation' into codex/compute-exec-ttl
• 8411a16 Merge branch 'feat/drop-unused-meter-definitions' of github.com-joseszycho:datum-cloud/compute into feat/drop-unused-meter-definitions
• e6cb66c Merge branch 'main' into codex/compute-exec-ttl
• 732b325 Merge branch 'main' into feat/drop-unused-meter-definitions
• 7043698 Merge pull request #​486 from datum-cloud/feat/drop-unused-meter-definitions
• 88a7101 Merge pull request #​497 from datum-cloud/codex/compute-exec-ttl
• 0aa32db Merge pull request #​499 from datum-cloud/codex/fix-suspension-propagation
• 0a10628 Merge pull request [#​502](https://redirect.github.com/datum-cloud/

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 6am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Ask Polylane for an impact assessment of this pull request:

[ecv]

Request changes.

Lint and Unit Tests fail at f711bbe, and the failure comes from this bump: it moves k8s.io/* to v0.37, controller-runtime to v0.25.2 and the NSO/compute modules together, and the envtest suites now fail at server start (api/network/v1alpha1/fabric_admission_envtest_test.go:50) while golangci-lint reports "no go files to analyze", so lint cannot load the packages (likely a compile or tidy failure from the bump).

• The Unit Tests job installs envtest binaries for 1.35.x with setup-envtest@release-0.24, which is out of step with controller-runtime v0.25.2 / client-go v0.37.1. The envtest setup and the lint job need to move with the libraries.
• Split the bump so the safe parts can land: quic-go, netlink, ipam, fxamacker/cbor and k8s.io/utils are independent of the Kubernetes minor.

Follow-ups:

• Client libraries at 0.37 are fine while the clusters stay on 1.36, but the move should be one deliberate PR that updates the envtest version and any API changes together.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
golang.org/x/mod	v0.41.0 -> v0.42.0