NO-ISSUE: Bump the fulfillment-service-go-dependencies group in /fulfillment-service with 7 updates by dependabot[bot] · Pull Request #678 · osac-project/osac

dependabot · 2026-09-01T09:31:06Z

Bumps the fulfillment-service-go-dependencies group in /fulfillment-service with 7 updates:

Package	From	To
buf.build/go/protovalidate	`1.2.0`	`1.3.0`
github.com/grpc-ecosystem/grpc-gateway/v2	`2.29.0`	`2.30.0`
github.com/open-policy-agent/opa	`1.18.2`	`1.20.1`
k8s.io/apimachinery	`0.36.4`	`0.37.0`
k8s.io/client-go	`0.36.4`	`0.37.0`
github.com/bits-and-blooms/bitset	`1.24.6`	`1.25.0`
github.com/onsi/gomega	`1.42.1`	`1.43.0`

Updates buf.build/go/protovalidate from 1.2.0 to 1.3.0

Release notes

Sourced from buf.build/go/protovalidate's releases.

v1.3.0

This release adds support for Native standard validation rules which greatly improve evaluation performance. See bufbuild/protovalidate-go#316 for more details.

What's Changed

Implement native rules for the predefined protovalidate rules by @jonbodner-buf in bufbuild/protovalidate-go#316

Fix error message for string.not_contains in native rules by @jonbodner-buf in bufbuild/protovalidate-go#319

Improve formatting, NaN handling, and header validation by @jonbodner-buf in bufbuild/protovalidate-go#320

Fix regression in Violation.RuleValue for native rules by @pkwarren in bufbuild/protovalidate-go#325

Exclude the trailing dot from the hostname 253-character limit by @LordAizen1 in bufbuild/protovalidate-go#332

Use CEL PartialVars during AST pruning by @TristonianJones in bufbuild/protovalidate-go#333

New Contributors

@jonbodner-buf made their first contribution in bufbuild/protovalidate-go#317

@LordAizen1 made their first contribution in bufbuild/protovalidate-go#332

@TristonianJones made their first contribution in bufbuild/protovalidate-go#333

Full Changelog: bufbuild/protovalidate-go@v1.2.0...v1.3.0

Commits

0e5a75c Use CEL PartialVars during AST pruning (#333)
373085b Exclude the trailing dot from the hostname 253-character limit (#332)
37b55cc Bump github.com/google/cel-go from 0.29.2 to 0.30.0 in the go group (#331)
f360e52 Bump actions/setup-go from 6 to 7 in the github-actions group (#330)
9292b3d Bump the go group with 2 updates (#329)
24f3f25 Bump github.com/google/cel-go from 0.28.1 to 0.29.1 in the go group (#328)
fc2e52b Bump actions/checkout from 6 to 7 in the github-actions group (#326)
574c1e5 Fix regression in Violation.RuleValue for native rules (#325)
6f82807 Bump github.com/google/cel-go from 0.28.0 to 0.28.1 in the go group (#321)
800f2cc Improve formatting, NaN handling, and header validation (#320)
Additional commits viewable in compare view

Updates github.com/grpc-ecosystem/grpc-gateway/v2 from 2.29.0 to 2.30.0

Release notes

Sourced from github.com/grpc-ecosystem/grpc-gateway/v2's releases.

v2.30.0

New Features

protoc-gen-openapiv3: Brand new minimal OpenAPI v3 generator (#6623), plus follow-ups:

Visibility selectors (#6673)

disable_default_errors option (#6672)

Annotation support (#6681)

Improved plugin error surfacing (#6937)

field_behavior REQUIRED support for query parameters (#7180) — @maydietwice

openapiv3-merge: New standalone tool for merging OpenAPI v3 documents (#6771) — @johanbrandhorst

protoc-gen-openapiv2 moved to the protoc toolchain (#6988) — @EliSauder

Fixes

Change PR Contributor

OpenAPI v2: messages sorted before rendering definitions for determinism #6732 @alliasgher

OpenAPI v2: enum comments now go to description instead of title #6785 @superShen0916

OpenAPI v2: include field schema metadata on parameters #6894 @puneetdixit200

OpenAPI v2: omit empty body objects for nested path parameters #7065 @alliasgher

OpenAPI v3: omit empty body objects for nested path parameters #7068 @alliasgher

OpenAPI v2: preserve x-nullable when use_allof_for_refs wraps a $ref #7026 @pkhanaljc

OpenAPI v2: fix path joining for colon-prefixed segments #7191 @Ritik100-AIT

Prioritize OpenAPI config options over proto options #6973 @maskedmaxx

Support Service doc comments for OpenAPI/Swagger generation #6200 @majiayu000

Fix nested body path initialization for oneof fields #6948 @cyphercodes

Remove redundant enum assignment for nested proto3 fields #7059 @abhishek-dalbanjan

Drain request only after ParseForm in generated code #7192 @paskozdilar

Support field extensions with use_allof_for_refs #3100 @same-id

Ignore M import-path mappings in openapiv3 plugin params #6936 @johanbrandhorst

Documentation

Clarify HttpBody download usage (#6904) — @ketpatil77

Clarify Go tool dependency options (#7042) — @hawk-roy

Add a runnable OpenTelemetry tracing example (#7110) — @hsdfat

Fix SLSA link in README (#7149) — @ZayanKhan-12

Explain Buf strategy for shared API config (#7147) — @dlanov

Tests / CI / Infra

Add test coverage for slice converters in convert.go (#7041) — @viniciusmtsantos

Remove Java swagger generator test dependency (#6735) — @johanbrandhorst

CI improvements — go-version-file usage, release workflow tag input, checkout ref fixes, node_test timeouts, Node 22 LTS for browser tests (avoids a Node 24 zlib hang) (#6627, #6632, #6633, #6867, #6868) — @johanbrandhorst

Better Bazel caching; auto-merge job for dependabot PRs (#6667, #6668) — @johanbrandhorst

Run gazelle on openapiv3 files; add missing Bazel files (#6734, #6738) — @johanbrandhorst

New Contributors

@alliasgher, @superShen0916, @puneetdixit200, @ketpatil77, @EliSauder, @maskedmaxx, @hawk-roy, @viniciusmtsantos, @cyphercodes, @abhishek-dalbanjan, @hsdfat, @ZayanKhan-12, @dlanov, @maydietwice, @pkhanaljc, @Ritik100-AIT

... (truncated)

Commits

1debdea Fix openapiv2 path joining for colon-prefixed segments (#7191)
561f393 Drain request only after ParseForm in generated code (#7192)
a16cad8 fix(openapiv2): preserve x-nullable when use_allof_for_refs wraps $ref (#7026)
544d99d openapiv3: support field_behavior REQUIRED for query parameters (#7180)
89a9e41 chore(deps): update google/oss-fuzz digest to 3ea2a9b (#7195)
42ced5f fix(deps): update opentelemetry-go-contrib monorepo to v0.70.0 (#7194)
c63e364 chore(deps): update googleapis digest to 5739471 (#7193)
873f41a chore(deps): update google/oss-fuzz digest to 8d292af (#7190)
f56f8ad chore(deps): update googleapis digest to f3ff3a1 (#7189)
3087cc7 build(deps-dev): bump fast-uri in /examples/internal/browser (#7187)
Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa from 1.18.2 to 1.20.1

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.20.1

This release includes a bug fix for a regression introduced in v1.20.0 in comparing a number to some float values. Thanks @kmadan for reporting the issue and submitting a fix!

v1.20.0

This release contains a mix of new features and bug fixes. Notably:

New Rego keywords: and and or, for combining conditions inside a single rule body

allow_net now restricts remote JSON Schema $ref fetching from json.match_schema and json.verify_schema

Coverage reports can now explain why a range is not covered

Much faster partial evaluation for dynamically composed policies

New Rego keywords: and and or (#7602)

Rego gains two keywords for combining conditions inside a single rule body — a long-standing request, and one of the larger additions to the language in some time. and and or let control flow that previously had to be split across helper rules stay where it is read.

Before, a rule body that needed to succeed on one of several conditions meant extracting a rule:
package example
allow if {
input.method == "GET"
admin_or_public_owner
}
admin_or_public_owner if input.user.admin
admin_or_public_owner if {
input.user.owner
input.resource.public
}
Now:
package example
import future.keywords.and
import future.keywords.or
the and groups first, so this reads as:
an admin, or an owner of a public resource
allow if {
input.method == "GET"
</tr></table>

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.20.1

This release includes a bug fix for a regression introduced in v1.20.0 in comparing a number to some float values. Thanks @kmadan for reporting the issue and submitting a fix!

1.20.0

This release contains a mix of new features and bug fixes. Notably:

New Rego keywords: and and or, for combining conditions inside a single rule body

allow_net now restricts remote JSON Schema $ref fetching from json.match_schema and json.verify_schema

Coverage reports can now explain why a range is not covered

Much faster partial evaluation for dynamically composed policies

New Rego keywords: and and or (#7602)

Rego gains two keywords for combining conditions inside a single rule body — a long-standing request, and one of the larger additions to the language in some time. and and or let control flow that previously had to be split across helper rules stay where it is read.

Before, a rule body that needed to succeed on one of several conditions meant extracting a rule:
package example
allow if {
input.method == "GET"
admin_or_public_owner
}
admin_or_public_owner if input.user.admin
admin_or_public_owner if {
input.user.owner
input.resource.public
}
Now:
package example
import future.keywords.and
import future.keywords.or
the and groups first, so this reads as:
an admin, or an owner of a public resource
allow if {
</tr></table>

... (truncated)

Commits

72f30d6 Prepare v1.20.1 release
ceb4bf2 ast: fix panic comparing a decimal zero with a non-integral number (#9099)
328ca09 Prepare v1.20.0 release (#9095)
ce7ab30 Add Scanara to the OPA ecosystem page. (#9094)
cbc0993 ast: Index rules with and/or expressions (#9063)
54bf329 fix loading absolute paths on Windows (#9055)
48310c6 format: Honor line breaks before explicit and/or operand bodies (#9086)
a3953de build/release: Create new release tool (#8959)
ec9536c format: converge object comprehension layout (#9076)
255adec ast: Fix future.keywords wildcard import not including the not keyword (#...
Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.36.4 to 0.37.0

Commits

7164e39 Update dependencies to v0.37.0 tag
e55f9ba feat(api): Update node restriction admission to use new API
cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis
97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api
f21afab Add validation for camelcase in reason field
d7ad413 Merge pull request #140782 from dims/update-kube-openapi
e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist
464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key
95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...
Additional commits viewable in compare view

Updates k8s.io/client-go from 0.36.4 to 0.37.0

Commits

2807644 Update dependencies to v0.37.0 tag
50c6f9b metrics: Register: Fix incorrect assignment
49f0a7b Merge pull request #140931 from pohly/client-go-changelog-adding-apigroups
74d4b1e Merge pull request #140966 from alancaldelas/client-go-fakecustomstore-store
2bf14f2 Merge pull request #140990 from xigang/revert-140448
7b892fe Revert "Merge pull request #140448 from xigang/event_broadcaster_goroutine_leak"
df92378 Merge pull request #140334 from nojnhuh/dra-workloadresourceclaims-beta
45a0ff1 client-go: restore FakeCustomStore conformance to cache.Store
9d3b531 Merge pull request #139795 from omeryahud/worktree-kep-5963-device-compat-groups
694f4eb apidiff: ignore adding entirely new API groups
Additional commits viewable in compare view

Updates github.com/bits-and-blooms/bitset from 1.24.6 to 1.25.0

Release notes

Sourced from github.com/bits-and-blooms/bitset's releases.

Version 1.25.0

What's Changed

feat: add SetRange method to BitSet by @T-J-L in bits-and-blooms/bitset#228

fix deleteat by @lemire in bits-and-blooms/bitset#226

test: raise coverage with edge-case tests, pextgen tests, and godoc examples by @nicolaasuni in bits-and-blooms/bitset#223

New Contributors

@T-J-L made their first contribution in bits-and-blooms/bitset#228

Full Changelog: bits-and-blooms/bitset@v1.24.6...v1.25.0

Commits

222fc1c Merge pull request #223 from tecnickcom/testing
154e055 Merge pull request #226 from bits-and-blooms/fix/deleteat-shrink-slice
bb7c7fb Merge pull request #228 from T-J-L/setall
2d81193 Potential fix for pull request finding
db937a3 feat: add SetRange method to BitSet
79a6ce7 fix deleteat
8c78148 Add Go versions 1.25.x and 1.26.x to test matrix
44c4782 Merge pull request #220 from bits-and-blooms/dependabot/github_actions/github...
8160780 build: add missing legacy build header
1dff309 test: raise coverage with edge-case tests, pextgen tests, and godoc examples
Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.42.1 to 1.43.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.43.0

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Commits

bc1f21e v1.43.0
c814c0e v1.43.0 (full)
a89f25d Add gomock adaptor extension for using Gomega matchers with gomock
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the fulfillment-service-go-dependencies group in /fulfillment-service with 7 updates: | Package | From | To | | --- | --- | --- | | [buf.build/go/protovalidate](https://github.com/bufbuild/protovalidate-go) | `1.2.0` | `1.3.0` | | [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) | `2.29.0` | `2.30.0` | | [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.18.2` | `1.20.1` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.4` | `0.37.0` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.4` | `0.37.0` | | [github.com/bits-and-blooms/bitset](https://github.com/bits-and-blooms/bitset) | `1.24.6` | `1.25.0` | | [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.42.1` | `1.43.0` | Updates `buf.build/go/protovalidate` from 1.2.0 to 1.3.0 - [Release notes](https://github.com/bufbuild/protovalidate-go/releases) - [Commits](bufbuild/protovalidate-go@v1.2.0...v1.3.0) Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.29.0 to 2.30.0 - [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases) - [Commits](grpc-ecosystem/grpc-gateway@v2.29.0...v2.30.0) Updates `github.com/open-policy-agent/opa` from 1.18.2 to 1.20.1 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.18.2...v1.20.1) Updates `k8s.io/apimachinery` from 0.36.4 to 0.37.0 - [Commits](kubernetes/apimachinery@v0.36.4...v0.37.0) Updates `k8s.io/client-go` from 0.36.4 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.36.4...v0.37.0) Updates `github.com/bits-and-blooms/bitset` from 1.24.6 to 1.25.0 - [Release notes](https://github.com/bits-and-blooms/bitset/releases) - [Commits](bits-and-blooms/bitset@v1.24.6...v1.25.0) Updates `github.com/onsi/gomega` from 1.42.1 to 1.43.0 - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](onsi/gomega@v1.42.1...v1.43.0) --- updated-dependencies: - dependency-name: buf.build/go/protovalidate dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: fulfillment-service-go-dependencies - dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2 dependency-version: 2.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: fulfillment-service-go-dependencies - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: fulfillment-service-go-dependencies - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: fulfillment-service-go-dependencies - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: fulfillment-service-go-dependencies - dependency-name: github.com/bits-and-blooms/bitset dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: fulfillment-service-go-dependencies - dependency-name: github.com/onsi/gomega dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: fulfillment-service-go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

openshift-ci-robot · 2026-09-01T09:31:11Z

@dependabot[bot]: This pull request explicitly references no jira issue.

Details

In response to this:

Bumps the fulfillment-service-go-dependencies group in /fulfillment-service with 7 updates:

Package From To

buf.build/go/protovalidate 1.2.0 1.3.0

github.com/grpc-ecosystem/grpc-gateway/v2 2.29.0 2.30.0

github.com/open-policy-agent/opa 1.18.2 1.20.1

k8s.io/apimachinery 0.36.4 0.37.0

k8s.io/client-go 0.36.4 0.37.0

github.com/bits-and-blooms/bitset 1.24.6 1.25.0

github.com/onsi/gomega 1.42.1 1.43.0

Updates buf.build/go/protovalidate from 1.2.0 to 1.3.0

Release notes

Sourced from buf.build/go/protovalidate's releases.

v1.3.0

This release adds support for Native standard validation rules which greatly improve evaluation performance. See bufbuild/protovalidate-go#316 for more details.

What's Changed

Implement native rules for the predefined protovalidate rules by @jonbodner-buf in bufbuild/protovalidate-go#316

Fix error message for string.not_contains in native rules by @jonbodner-buf in bufbuild/protovalidate-go#319

Improve formatting, NaN handling, and header validation by @jonbodner-buf in bufbuild/protovalidate-go#320

Fix regression in Violation.RuleValue for native rules by @pkwarren in bufbuild/protovalidate-go#325

Exclude the trailing dot from the hostname 253-character limit by @LordAizen1 in bufbuild/protovalidate-go#332

Use CEL PartialVars during AST pruning by @TristonianJones in bufbuild/protovalidate-go#333

New Contributors

@jonbodner-buf made their first contribution in bufbuild/protovalidate-go#317

@LordAizen1 made their first contribution in bufbuild/protovalidate-go#332

@TristonianJones made their first contribution in bufbuild/protovalidate-go#333

Full Changelog: bufbuild/protovalidate-go@v1.2.0...v1.3.0

Commits

0e5a75c Use CEL PartialVars during AST pruning (#333)

373085b Exclude the trailing dot from the hostname 253-character limit (#332)

37b55cc Bump github.com/google/cel-go from 0.29.2 to 0.30.0 in the go group (#331)

f360e52 Bump actions/setup-go from 6 to 7 in the github-actions group (#330)

9292b3d Bump the go group with 2 updates (#329)

24f3f25 Bump github.com/google/cel-go from 0.28.1 to 0.29.1 in the go group (#328)

fc2e52b Bump actions/checkout from 6 to 7 in the github-actions group (#326)

574c1e5 Fix regression in Violation.RuleValue for native rules (#325)

6f82807 Bump github.com/google/cel-go from 0.28.0 to 0.28.1 in the go group (#321)

800f2cc Improve formatting, NaN handling, and header validation (#320)

Additional commits viewable in compare view

Updates github.com/grpc-ecosystem/grpc-gateway/v2 from 2.29.0 to 2.30.0

Release notes

Sourced from github.com/grpc-ecosystem/grpc-gateway/v2's releases.

v2.30.0

New Features

protoc-gen-openapiv3: Brand new minimal OpenAPI v3 generator (#6623), plus follow-ups:

Visibility selectors (#6673)

disable_default_errors option (#6672)

Annotation support (#6681)

Improved plugin error surfacing (#6937)

field_behavior REQUIRED support for query parameters (#7180) — @maydietwice

openapiv3-merge: New standalone tool for merging OpenAPI v3 documents (#6771) — @johanbrandhorst

protoc-gen-openapiv2 moved to the protoc toolchain (#6988) — @EliSauder

Fixes

Change PR Contributor

OpenAPI v2: messages sorted before rendering definitions for determinism #6732 @alliasgher

OpenAPI v2: enum comments now go to description instead of title #6785 @superShen0916

OpenAPI v2: include field schema metadata on parameters #6894 @puneetdixit200

OpenAPI v2: omit empty body objects for nested path parameters #7065 @alliasgher

OpenAPI v3: omit empty body objects for nested path parameters #7068 @alliasgher

OpenAPI v2: preserve x-nullable when use_allof_for_refs wraps a $ref #7026 @pkhanaljc

OpenAPI v2: fix path joining for colon-prefixed segments #7191 @Ritik100-AIT

Prioritize OpenAPI config options over proto options #6973 @maskedmaxx

Support Service doc comments for OpenAPI/Swagger generation #6200 @majiayu000

Fix nested body path initialization for oneof fields #6948 @cyphercodes

Remove redundant enum assignment for nested proto3 fields #7059 @abhishek-dalbanjan

Drain request only after ParseForm in generated code #7192 @paskozdilar

Support field extensions with use_allof_for_refs #3100 @same-id

Ignore M import-path mappings in openapiv3 plugin params #6936 @johanbrandhorst

Documentation

Clarify HttpBody download usage (#6904) — @ketpatil77

Clarify Go tool dependency options (#7042) — @hawk-roy

Add a runnable OpenTelemetry tracing example (#7110) — @hsdfat

Fix SLSA link in README (#7149) — @ZayanKhan-12

Explain Buf strategy for shared API config (#7147) — @dlanov

Tests / CI / Infra

Add test coverage for slice converters in convert.go (#7041) — @viniciusmtsantos

Remove Java swagger generator test dependency (#6735) — @johanbrandhorst

CI improvements — go-version-file usage, release workflow tag input, checkout ref fixes, node_test timeouts, Node 22 LTS for browser tests (avoids a Node 24 zlib hang) (#6627, #6632, #6633, #6867, #6868) — @johanbrandhorst

Better Bazel caching; auto-merge job for dependabot PRs (#6667, #6668) — @johanbrandhorst

Run gazelle on openapiv3 files; add missing Bazel files (#6734, #6738) — @johanbrandhorst

New Contributors

@alliasgher, @superShen0916, @puneetdixit200, @ketpatil77, @EliSauder, @maskedmaxx, @hawk-roy, @viniciusmtsantos, @cyphercodes, @abhishek-dalbanjan, @hsdfat, @ZayanKhan-12, @dlanov, @maydietwice, @pkhanaljc, @Ritik100-AIT

... (truncated)

Commits

1debdea Fix openapiv2 path joining for colon-prefixed segments (#7191)

561f393 Drain request only after ParseForm in generated code (#7192)

a16cad8 fix(openapiv2): preserve x-nullable when use_allof_for_refs wraps $ref (#7026)

544d99d openapiv3: support field_behavior REQUIRED for query parameters (#7180)

89a9e41 chore(deps): update google/oss-fuzz digest to 3ea2a9b (#7195)

42ced5f fix(deps): update opentelemetry-go-contrib monorepo to v0.70.0 (#7194)

c63e364 chore(deps): update googleapis digest to 5739471 (#7193)

873f41a chore(deps): update google/oss-fuzz digest to 8d292af (#7190)

f56f8ad chore(deps): update googleapis digest to f3ff3a1 (#7189)

3087cc7 build(deps-dev): bump fast-uri in /examples/internal/browser (#7187)

Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa from 1.18.2 to 1.20.1
Release notes

Sourced from github.com/open-policy-agent/opa's releases.
v1.20.1

This release includes a bug fix for a regression introduced in v1.20.0 in comparing a number to some float values. Thanks @kmadan for reporting the issue and submitting a fix!

v1.20.0

This release contains a mix of new features and bug fixes. Notably:

New Rego keywords: and and or, for combining conditions inside a single rule body

allow_net now restricts remote JSON Schema $ref fetching from json.match_schema and json.verify_schema

Coverage reports can now explain why a range is not covered

Much faster partial evaluation for dynamically composed policies

New Rego keywords: and and or (#7602)

Rego gains two keywords for combining conditions inside a single rule body — a long-standing request, and one of the larger additions to the language in some time. and and or let control flow that previously had to be split across helper rules stay where it is read.

Before, a rule body that needed to succeed on one of several conditions meant extracting a rule:
package example
allow if {
input.method == "GET"
admin_or_public_owner
}
admin_or_public_owner if input.user.admin
admin_or_public_owner if {
input.user.owner
input.resource.public
}
Now:
package example
import future.keywords.and
import future.keywords.or
the and groups first, so this reads as:
an admin, or an owner of a public resource
allow if {
input.method == "GET"
</tr></table>
... (truncated)
Changelog

Sourced from github.com/open-policy-agent/opa's changelog.
1.20.1

This release includes a bug fix for a regression introduced in v1.20.0 in comparing a number to some float values. Thanks @kmadan for reporting the issue and submitting a fix!

1.20.0

This release contains a mix of new features and bug fixes. Notably:

New Rego keywords: and and or, for combining conditions inside a single rule body

allow_net now restricts remote JSON Schema $ref fetching from json.match_schema and json.verify_schema

Coverage reports can now explain why a range is not covered

Much faster partial evaluation for dynamically composed policies

New Rego keywords: and and or (#7602)

Rego gains two keywords for combining conditions inside a single rule body — a long-standing request, and one of the larger additions to the language in some time. and and or let control flow that previously had to be split across helper rules stay where it is read.

Before, a rule body that needed to succeed on one of several conditions meant extracting a rule:
package example
allow if {
input.method == "GET"
admin_or_public_owner
}
admin_or_public_owner if input.user.admin
admin_or_public_owner if {
input.user.owner
input.resource.public
}
Now:
package example
import future.keywords.and
import future.keywords.or
the and groups first, so this reads as:
an admin, or an owner of a public resource
allow if {
</tr></table>
... (truncated)
Commits

72f30d6 Prepare v1.20.1 release

ceb4bf2 ast: fix panic comparing a decimal zero with a non-integral number (#9099)

328ca09 Prepare v1.20.0 release (#9095)

ce7ab30 Add Scanara to the OPA ecosystem page. (#9094)

cbc0993 ast: Index rules with and/or expressions (#9063)

54bf329 fix loading absolute paths on Windows (#9055)

48310c6 format: Honor line breaks before explicit and/or operand bodies (#9086)

a3953de build/release: Create new release tool (#8959)

ec9536c format: converge object comprehension layout (#9076)

255adec ast: Fix future.keywords wildcard import not including the not keyword (#...

Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.36.4 to 0.37.0

Commits

7164e39 Update dependencies to v0.37.0 tag

e55f9ba feat(api): Update node restriction admission to use new API

cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis

97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api

f21afab Add validation for camelcase in reason field

d7ad413 Merge pull request #140782 from dims/update-kube-openapi

e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist

464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad

0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key

95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...

Additional commits viewable in compare view

Updates k8s.io/client-go from 0.36.4 to 0.37.0

Commits

2807644 Update dependencies to v0.37.0 tag

50c6f9b metrics: Register: Fix incorrect assignment

49f0a7b Merge pull request #140931 from pohly/client-go-changelog-adding-apigroups

74d4b1e Merge pull request #140966 from alancaldelas/client-go-fakecustomstore-store

2bf14f2 Merge pull request #140990 from xigang/revert-140448

7b892fe Revert "Merge pull request #140448 from xigang/event_broadcaster_goroutine_leak"

df92378 Merge pull request #140334 from nojnhuh/dra-workloadresourceclaims-beta

45a0ff1 client-go: restore FakeCustomStore conformance to cache.Store

9d3b531 Merge pull request #139795 from omeryahud/worktree-kep-5963-device-compat-groups

694f4eb apidiff: ignore adding entirely new API groups

Additional commits viewable in compare view

Updates github.com/bits-and-blooms/bitset from 1.24.6 to 1.25.0

Release notes

Sourced from github.com/bits-and-blooms/bitset's releases.

Version 1.25.0

What's Changed

feat: add SetRange method to BitSet by @T-J-L in bits-and-blooms/bitset#228

fix deleteat by @lemire in bits-and-blooms/bitset#226

test: raise coverage with edge-case tests, pextgen tests, and godoc examples by @nicolaasuni in bits-and-blooms/bitset#223

New Contributors

@T-J-L made their first contribution in bits-and-blooms/bitset#228

Full Changelog: bits-and-blooms/bitset@v1.24.6...v1.25.0

Commits

222fc1c Merge pull request #223 from tecnickcom/testing

154e055 Merge pull request #226 from bits-and-blooms/fix/deleteat-shrink-slice

bb7c7fb Merge pull request #228 from T-J-L/setall

2d81193 Potential fix for pull request finding

db937a3 feat: add SetRange method to BitSet

79a6ce7 fix deleteat

8c78148 Add Go versions 1.25.x and 1.26.x to test matrix

44c4782 Merge pull request #220 from bits-and-blooms/dependabot/github_actions/github...

8160780 build: add missing legacy build header

1dff309 test: raise coverage with edge-case tests, pextgen tests, and godoc examples

Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.42.1 to 1.43.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.43.0

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Commits

bc1f21e v1.43.0

c814c0e v1.43.0 (full)

a89f25d Add gomock adaptor extension for using Gomega matchers with gomock

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency

@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)

@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)

@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)

@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency

@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-09-01T09:31:12Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign rccrdpccl for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

fulfillment-service/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dependabot · 2026-09-05T05:03:23Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 1, 2026

openshift-ci-robot added the jira/valid-reference label Sep 1, 2026

openshift-ci Bot requested a review from ori-amizur September 1, 2026 09:31

openshift-ci Bot requested a review from tzvatot September 1, 2026 09:31

dependabot Bot closed this Sep 5, 2026

dependabot Bot deleted the dependabot/go_modules/fulfillment-service/fulfillment-service-go-dependencies-f2882d5322 branch September 5, 2026 05:03

Change	PR	Contributor
OpenAPI v2: messages sorted before rendering definitions for determinism	#6732	`@alliasgher`
OpenAPI v2: enum comments now go to `description` instead of `title`	#6785	`@superShen0916`
OpenAPI v2: include field schema metadata on parameters	#6894	`@puneetdixit200`
OpenAPI v2: omit empty body objects for nested path parameters	#7065	`@alliasgher`
OpenAPI v3: omit empty body objects for nested path parameters	#7068	`@alliasgher`
OpenAPI v2: preserve `x-nullable` when `use_allof_for_refs` wraps a `$ref`	#7026	`@pkhanaljc`
OpenAPI v2: fix path joining for colon-prefixed segments	#7191	`@Ritik100-AIT`
Prioritize OpenAPI config options over proto options	#6973	`@maskedmaxx`
Support Service doc comments for OpenAPI/Swagger generation	#6200	`@majiayu000`
Fix nested body path initialization for oneof fields	#6948	`@cyphercodes`
Remove redundant enum assignment for nested proto3 fields	#7059	`@abhishek-dalbanjan`
Drain request only after `ParseForm` in generated code	#7192	`@paskozdilar`
Support field extensions with `use_allof_for_refs`	#3100	`@same-id`
Ignore `M` import-path mappings in openapiv3 plugin params	#6936	`@johanbrandhorst`

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.3.0

What's Changed

New Contributors

v2.30.0

New Features

Fixes

Documentation

Tests / CI / Infra

New Contributors

v1.20.1

v1.20.0

New Rego keywords: and and or (#7602)

1.20.1

1.20.0

New Rego keywords: and and or (#7602)

Version 1.25.0

What's Changed

New Contributors

v1.43.0

1.43.0

Features

1.43.0

Features

Uh oh!

openshift-ci-robot commented Sep 1, 2026

v1.3.0

What's Changed

New Contributors

v2.30.0

New Features

Fixes

Documentation

Tests / CI / Infra

New Contributors

v1.20.1

v1.20.0

New Rego keywords: and and or (#7602)

1.20.1

1.20.0

New Rego keywords: and and or (#7602)

Version 1.25.0

What's Changed

New Contributors

v1.43.0

1.43.0

Features

1.43.0

Features

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

New Rego keywords: `and` and `or` (#7602)

New Rego keywords: `and` and `or` (#7602)

New Rego keywords: `and` and `or` (#7602)

New Rego keywords: `and` and `or` (#7602)