Bump the go_modules group across 6 directories with 2 updates

[dependabot]

Bumps the go_modules group with 1 update in the /cmd/prism-admin directory: golang.org/x/crypto.
Bumps the go_modules group with 1 update in the /cmd/prism-web-console directory: golang.org/x/crypto.
Bumps the go_modules group with 1 update in the /pkg/authz directory: golang.org/x/crypto.
Bumps the go_modules group with 1 update in the /pkg/plugin directory: golang.org/x/crypto.
Bumps the go_modules group with 1 update in the /prism-operator directory: github.com/kedacore/keda/v2.
Bumps the go_modules group with 1 update in the /tests/acceptance/envcheck directory: golang.org/x/crypto.

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

• a1c0d99 go.mod: update golang.org/x dependencies
• 3c7c869 ssh: fix deadlock on unexpected channel responses
• 533fb3f ssh: fix source-address critical option bypass
• abbc44d ssh: fix incorrect operator order
• e052873 ssh: fix infinite loop on large channel writes due to integer overflow
• b61cf85 ssh: enforce user presence verification for security keys
• 9c2cd33 ssh: enforce strict limits on DSA key parameters
• 8907318 ssh: reject RSA keys with excessively large moduli
• ffd87b4 ssh: fix panic when authority callbacks are nil
• 4e7a738 ssh: fix deadlock on unexpected global responses
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

• a1c0d99 go.mod: update golang.org/x dependencies
• 3c7c869 ssh: fix deadlock on unexpected channel responses
• 533fb3f ssh: fix source-address critical option bypass
• abbc44d ssh: fix incorrect operator order
• e052873 ssh: fix infinite loop on large channel writes due to integer overflow
• b61cf85 ssh: enforce user presence verification for security keys
• 9c2cd33 ssh: enforce strict limits on DSA key parameters
• 8907318 ssh: reject RSA keys with excessively large moduli
• ffd87b4 ssh: fix panic when authority callbacks are nil
• 4e7a738 ssh: fix deadlock on unexpected global responses
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

• a1c0d99 go.mod: update golang.org/x dependencies
• 3c7c869 ssh: fix deadlock on unexpected channel responses
• 533fb3f ssh: fix source-address critical option bypass
• abbc44d ssh: fix incorrect operator order
• e052873 ssh: fix infinite loop on large channel writes due to integer overflow
• b61cf85 ssh: enforce user presence verification for security keys
• 9c2cd33 ssh: enforce strict limits on DSA key parameters
• 8907318 ssh: reject RSA keys with excessively large moduli
• ffd87b4 ssh: fix panic when authority callbacks are nil
• 4e7a738 ssh: fix deadlock on unexpected global responses
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

• a1c0d99 go.mod: update golang.org/x dependencies
• 3c7c869 ssh: fix deadlock on unexpected channel responses
• 533fb3f ssh: fix source-address critical option bypass
• abbc44d ssh: fix incorrect operator order
• e052873 ssh: fix infinite loop on large channel writes due to integer overflow
• b61cf85 ssh: enforce user presence verification for security keys
• 9c2cd33 ssh: enforce strict limits on DSA key parameters
• 8907318 ssh: reject RSA keys with excessively large moduli
• ffd87b4 ssh: fix panic when authority callbacks are nil
• 4e7a738 ssh: fix deadlock on unexpected global responses
• Additional commits viewable in compare view

Updates github.com/kedacore/keda/v2 from 2.17.3 to 2.20.0

Release notes

Sourced from github.com/kedacore/keda/v2's releases.

v2.20.0

We are happy to release KEDA 2.20.0 🎉

⚠️ Upgrade note: events moved to events.k8s.io (#7781)

With the Kubernetes 0.35 dependency bump, KEDA now records Kubernetes events via the events.k8s.io API group instead of the legacy core events resource. If you deploy KEDA with custom or restricted RBAC, grant the operator create/patch on events.k8s.io/events before upgrading, otherwise event recording will fail. The bundled KEDA manifests and Helm chart already include the updated permissions.

Highlights:

• Introduce new OpenSearch Scaler
• Introduce Elastic Forecast Scaler
• Add scalingModifiers fallback behavior
• Add support for AWS External ID in TriggerAuthentication podIdentity for all AWS scalers
• Add scaler HTTP request metrics for outbound requests made during metric collection

Learn how to deploy KEDA by reading our documentation.

🗓️ The next KEDA release is currently being estimated for 2nd week of September 2026, learn more in our roadmap.

New

• General: Add scalingModifiers fallback behavior (#7366)
• General: Introduce Elastic Forecast Scaler (#7494)
• General: Introduce new OpenSearch Scaler (#7456)

Improvements

• General: Add cooldownPeriod and pollingInterval checks for ScaledObject (#7271)
• General: Add CRD-level validation markers (Minimum, MinLength, MinItems, Enum) for ScaledObject, ScaledJob, ScaleTriggers, and TriggerAuthentication API types (#7533)
• General: Add --leader-election-id flag to allow configuring the leader election Lease name (#7564)
• General: Add scaler HTTP request metrics (keda_scaler_http_requests_total, keda_scaler_http_request_duration_seconds) for outbound HTTP requests made during scaler metric collection (#6600)
• General: Allow more control of TLS versions & ciphers via KEDA_HTTP_TLS_CIPHER_LIST, KEDA_SERVICE_TLS_CIPHER_LIST and KEDA_SERVICE_MIN_TLS_VERSION env vars (#7617)
• General: Cap each scalers-cache reader at a per-reader budget derived from globalHTTPTimeout so ScalersCache.Close cannot block indefinitely (#7574)
• General: Make APIService cert injections optional (#7559)
• General: Remove unconditional json.MarshalIndent calls from admission webhook validation hot paths; replace spec-comparison MarshalIndent-and-string-compare in isRemovingFinalizer variants with reflect.DeepEqual. Prevents webhook OOM under sustained admission load at large scale (observed at ~60k ScaledObjects) (#7670)
• AWS Scalers: Add support for AWS External ID in TriggerAuthentication podIdentity for all AWS scalers (SQS, Kinesis, DynamoDB, CloudWatch, etc.) to enable cross-account access scenarios (#6921)
• Elasticsearch Scaler: Add HTTP status check for Elasticsearch errors (#7480)
• Github Runner Scaler: Handle rate limit errors by respecting X-RateLimit-Reset and Retry-After headers and returning cached queue length (#7683)
• Kubernetes Workload Scaler: Add groupByNode parameter (#7628)
• Metrics API Scaler: Add custom HTTP client timeout (#7549)
• MSSQL Scaler: Add Azure Workload Identity support for Azure SQL authentication (#6104)
• Prometheus Scaler: Emit metric tracking empty responses from Prometheus (#7062)
• RabbitMQ Scaler: Add support for OAuth2 authentication for RabbitMQ over HTTP (#7379)
• Temporal Scaler: Add support for scaling based on Worker Deployment Version backlog via new workerDeploymentName and workerDeploymentBuildId fields. Deprecate buildId, selectAllActive, and selectUnversioned because those parameters are used for Rules-Based Worker Versioning, which was a short-lived experimental feature that has been deprecated in the Temporal server since December 2024 and will stop being supported soon. Users of Rules-Based Worker Versioning should use Worker Deployments instead. (#7672)

Fixes

• General: Check updated status for Fallback condition instead of ScaledObject (#7488)

... (truncated)

Changelog

Sourced from github.com/kedacore/keda/v2's changelog.

v2.20.0

New

• General: Add scalingModifiers fallback behavior (#7366)
• General: Introduce Elastic Forecast Scaler (#7494)
• General: Introduce new OpenSearch Scaler (#7456)

Improvements

• General: Add cooldownPeriod and pollingInterval checks for ScaledObject (#7271)
• General: Add CRD-level validation markers (Minimum, MinLength, MinItems, Enum) for ScaledObject, ScaledJob, ScaleTriggers, and TriggerAuthentication API types (#7533)
• General: Add --leader-election-id flag to allow configuring the leader election Lease name (#7564)
• General: Add scaler HTTP request metrics (keda_scaler_http_requests_total, keda_scaler_http_request_duration_seconds) for outbound HTTP requests made during scaler metric collection (#6600)
• General: Allow more control of TLS versions & ciphers via KEDA_HTTP_TLS_CIPHER_LIST, KEDA_SERVICE_TLS_CIPHER_LIST and KEDA_SERVICE_MIN_TLS_VERSION env vars (#7617)
• General: Cap each scalers-cache reader at a per-reader budget derived from globalHTTPTimeout so ScalersCache.Close cannot block indefinitely (#7574)
• General: Make APIService cert injections optional (#7559)
• General: Remove unconditional json.MarshalIndent calls from admission webhook validation hot paths; replace spec-comparison MarshalIndent-and-string-compare in isRemovingFinalizer variants with reflect.DeepEqual. Prevents webhook OOM under sustained admission load at large scale (observed at ~60k ScaledObjects) (#7670)
• AWS Scalers: Add support for AWS External ID in TriggerAuthentication podIdentity for all AWS scalers (SQS, Kinesis, DynamoDB, CloudWatch, etc.) to enable cross-account access scenarios (#6921)
• Elasticsearch Scaler: Add HTTP status check for Elasticsearch errors (#7480)
• Github Runner Scaler: Handle rate limit errors by respecting X-RateLimit-Reset and Retry-After headers and returning cached queue length (#7683)
• Kubernetes Workload Scaler: Add groupByNode parameter (#7628)
• Metrics API Scaler: Add custom HTTP client timeout (#7549)
• MSSQL Scaler: Add Azure Workload Identity support for Azure SQL authentication (#6104)
• Prometheus Scaler: Emit metric tracking empty responses from Prometheus (#7062)
• RabbitMQ Scaler: Add support for OAuth2 authentication for RabbitMQ over HTTP (#7379)
• Temporal Scaler: Add support for scaling based on Worker Deployment Version backlog via new workerDeploymentName and workerDeploymentBuildId fields. Deprecate buildId, selectAllActive, and selectUnversioned because those parameters are used for Rules-Based Worker Versioning, which was a short-lived experimental feature that has been deprecated in the Temporal server since December 2024 and will stop being supported soon. Users of Rules-Based Worker Versioning should use Worker Deployments instead. (#7672)

Fixes

• General: Add controller-runtime cache field indexes for ScaledObject admission validation so verifyScaledObjects and verifyHpas look up duplicate scaleTargetRef and HPA-name conflicts via indexed Lists rather than full-namespace scans, eliminating the webhook OOM under high-scale creation bursts (#7681)
• General: Check updated status for Fallback condition instead of ScaledObject (#7488)
• General: Fail fast in GetMetrics when the gRPC connection is in Shutdown state instead of waiting for context timeout (#7251)
• General: Fix int64 overflow in milli-quantity conversion for very large metric values (#7441)
• General: Fix keda_scaler_active not being emitted for CPU and memory triggers (#4945)
• General: Fix misleading namespace in error log when secret access is restricted (#7739)
• General: Fix race in scalers cache rebuild that caused transient scaler errors (#7574)
• General: Fix ScaledJob emitting wrong CloudEvent type (ScaledObjectReadyType instead of ScaledJobReadyType) when transitioning to ready state (#7792)
• General: Fix ScaledObject admission webhook to return validation error from verifyReplicaCount, preventing invalid ScaledObjects from being created (#5954)
• General: Fix ScaledObject Ready condition not reflecting HPA status (#7649)
• General: Guard GetCurrentReplicas against nil Status.ScaleTargetGVKR to prevent operator panics under the cache race documented in (#4389) / (#4955)
• General: Handle paused scaling directly in reconciler (#7663)
• General: Honor stderrthreshold when logtostderr is enabled by updating klog to v2.140.0 (#7568)
• General: Limit projected service account token reads during Vault authentication (#7783)
• General: Reject ScaledObject creation and update when the name exceeds 63 characters (#6998)
• AWS Scalers: Fix TCP connection leak by closing HTTP idle connections on scaler Close() for SQS, Kinesis, DynamoDB, DynamoDB Streams, and CloudWatch scalers (#7756)
• Azure Data Explorer Scaler: Remove clientSecretFromEnv support (#7554)
• Azure Event Hub Scaler: Reject non-positive unprocessedEventThreshold to prevent integer division by zero when computing lag (#7732)
• Azure Pipelines Scaler: Exclude already-assigned jobs from queue length (#7747)
• Cron Scaler: Fix metric name generation so cron expressions with comma-separated values no longer produce invalid metric names (#7448)

... (truncated)

Commits

• 5322ecb chore: prepare release v2.20.0 (#7810)
• 9fca167 e2e: disable flaky accurate_scaling_strategy test (#7807)
• eb9f6bf fix(splunk-observability): poll for pod readiness in e2e test (#7805)
• 4e7e459 fix(test): unbreak scale_handler_test build after events recorder migration (...
• 92bca15 fix: emit active metric for resource scalers (#7755)
• df4171d e2e: re-enable dynatrace tests (#7797)
• b130527 fix(e2e): match events by content to de-flake events test (#7804)
• 3a1ac48 Bump k8s deps to 0.35.5 and bump deps (#7781)
• 4c153d2 ci: bump e2e node-pool from 3 to 5 (#7800)
• 3a9e19e fix(splunk-observability): prevent indefinite block on stuck stream (#7799)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits

• a1c0d99 go.mod: update golang.org/x dependencies
• 3c7c869 ssh: fix deadlock on unexpected channel responses
• 533fb3f ssh: fix source-address critical option bypass
• abbc44d ssh: fix incorrect operator order
• e052873 ssh: fix infinite loop on large channel writes due to integer overflow
• b61cf85 ssh: enforce user presence verification for security keys
• 9c2cd33 ssh: enforce strict limits on DSA key parameters
• 8907318 ssh: reject RSA keys with excessively large moduli
• ffd87b4 ssh: fix panic when authority callbacks are nil
• 4e7a738 ssh: fix deadlock on unexpected global responses
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[mergify]

The PR Status Check has failed. Please review the CI logs and fix any issues.

Common issues:

• Test failures
• Linting errors
• Documentation validation failures

You can run checks locally:

task test-parallel-fast  # Run tests
task lint-parallel       # Run linters
uv run tooling/validate_docs.py  # Validate docs