Update module k8s.io/klog/v2 to v2.140.0

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
k8s.io/klog/v2	v2.130.1 → v2.140.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

kubernetes/klog (k8s.io/klog/v2)

v2.140.0: Prepare klog release for Kubernetes v1.36

Compare Source

What's Changed

• Add dependabot by @​lucacome in #​410
• Use strconv.AppendQuote instead of strconv.Quote for message formatting by @​astef in #​413
• de-duplication of key/value pairs by @​pohly in #​415
• Fix: Ensure constant format strings in fmt and printf calls by @​mikelolasagasti in #​417
• Remove old note on Go version requirements by @​guettli in #​425
• test with 1.24 and 1.25 by @​pohly in #​428
• ktesting: fix vmodule support by @​pohly in #​431
• ktesting: support multi-line result from AnyToStringHook by @​pohly in #​433
• textlogger: optionally turn off header by @​pohly in #​430
• feat: fix stderrthreshold not honored when logtostderr is set (#​212) + two new flags by @​pierluigilenoci in #​432

New Contributors

• @​lucacome made their first contribution in #​410
• @​astef made their first contribution in #​413
• @​mikelolasagasti made their first contribution in #​417
• @​guettli made their first contribution in #​425
• @​pierluigilenoci made their first contribution in #​432

Full Changelog: kubernetes/klog@v2.130.1...v2.140.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

This change updates the indirect dependency k8s.io/klog/v2 in go.mod from v2.130.1 to v2.140.0. No other modules or exported entities were modified.

Changes

Dependency Update

Layer / File(s)	Summary
Update klog/v2 version go.mod	Bumps the indirect dependency k8s.io/klog/v2 from v2.130.1 to v2.140.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: lgtm, dependencies, go

Suggested reviewers: rcampos2029, miguelhbrito

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Weak-Crypto	✅ Passed	Only go.mod/go.sum were updated for k8s.io/klog/v2; the diff shows no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	PR only updates go.mod/go.sum for klog; no container/K8s manifests or privilege settings were changed.
No-Sensitive-Data-In-Logs	✅ Passed	Only go.mod/go.sum changed for a klog version bump; no code or logging statements were added.
No-Hardcoded-Secrets	✅ Passed	Only dependency metadata changed (go.mod/go.sum); no secret-like literals, credentials, private keys, or api_key/secret/token/password assignments were added.
No-Injection-Vectors	✅ Passed	Only go.mod/go.sum changed for klog version bump; no source code or flagged injection sinks were added.
Ai-Attribution	✅ Passed	No AI-tool use is mentioned in the PR or commit message; no Co-Authored-By, Assisted-by, or Generated-by trailers were found.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the only change: bumping k8s.io/klog/v2 to v2.140.0.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/k8s.io-klog-v2-2.x

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

New changes are detected. LGTM label has been removed.

[coderabbitai]

🧹 Nitpick comments (1)

go.mod (1)

153-153: 🔒 Security & Privacy | 🔵 Trivial

Add provenance attestation and signing for this dependency bump. SBOM generation is already in place, but Sigstore/cosign signing is not wired up here.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 153, Add provenance attestation and Sigstore/cosign signing
to the dependency-update workflow associated with the k8s.io/klog/v2 bump,
reusing the existing SBOM generation flow. Ensure the resulting artifacts are
signed and provenance attestations are emitted; do not modify the dependency
version itself.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@go.mod`:
- Line 153: Add provenance attestation and Sigstore/cosign signing to the
dependency-update workflow associated with the k8s.io/klog/v2 bump, reusing the
existing SBOM generation flow. Ensure the resulting artifacts are signed and
provenance attestations are emitted; do not modify the dependency version
itself.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 11a4d2d2-05cb-46d6-936b-b73d3d12c0e2

📥 Commits

Reviewing files that changed from the base of the PR and between 9217b64 and 1f3a490.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod