Build(deps): Bump k8s.io/apimachinery from 0.34.3 to 0.36.3

[dependabot]

Bumps k8s.io/apimachinery from 0.34.3 to 0.36.3.

Commits

• 40bf4b2 Update dependencies to v0.36.3 tag
• 34d46be Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• 66a3724 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• 2ec982d Merge pull request #139508lalitc375/automated-cherry-pick-of-#139480
• 6a88102 Fix wrong marking of errors
• efb7f26 Merge remote-tracking branch 'origin/master' into release-1.36
• d966e56 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• 79b3632 Merge pull request #137864 from yongruilin/dv-dra-mismatch
• a8822f7 Add slice and map union member support with tests
• 7dba2d0 Use IsZero instead of IsNil for union ratcheting check
• Additional commits viewable in compare view

Summary by CodeRabbit

• Chores
  • Updated the application’s Go toolchain and supporting Kubernetes and protobuf components.
  • Refreshed logging and serialization dependencies for improved compatibility and maintenance.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: dependabot[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: dependabot[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: dependabot[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Updates the Go toolchain directive and Kubernetes-related module dependencies in go.mod. Removes an indirect protobuf dependency and updates indirect protobuf and klog versions.

Changes

Module updates

Layer / File(s)	Summary
Toolchain and dependency alignment go.mod	Raises the Go directive to 1.26.0, updates k8s.io/apimachinery, removes github.com/gogo/protobuf, and updates indirect protobuf and klog dependencies.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• openshift-online/ocm-cli#1213: Contains the same Go toolchain and dependency updates.

Suggested reviewers: rcampos2029, miguelhbrito

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Weak-Crypto	✅ Passed	The PR changes only go.mod and go.sum. The diff adds no weak algorithm or crypto implementation, and source scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, or secret comparisons.
Container-Privileges	✅ Passed	HEAD changes only go.mod and go.sum; scans found no flagged privilege settings, and the Dockerfile runtime image uses USER 1001.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only go.mod and go.sum; no Go source files, logging calls, or log-message content were added.
No-Hardcoded-Secrets	✅ Passed	The PR changes only go.mod and go.sum dependency metadata; no API keys, credentials, passwords, private keys, credential URLs, or secret assignments were added.
No-Injection-Vectors	✅ Passed	The PR changes only go.mod and go.sum. No source or script changes introduce SQL concatenation, shell execution, eval/exec, unsafe YAML, pickle, or HTML injection.
Ai-Attribution	✅ Passed	The PR description and commit mention no AI tool. The only trailer is Dependabot's Signed-off-by; no AI Co-authored-By, Assisted-by, or Generated-by trailer is present.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: updating k8s.io/apimachinery from 0.34.3 to 0.36.3.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/k8s.io/apimachinery-0.36.3

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 3: Update the Go version configuration in the check-pull-request and
publish-release workflow definitions to use Go 1.26.0, matching the version
declared by go.mod. Replace the existing 1.25 and 1.23 pins while leaving the
surrounding CI and release steps unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a112d737-6847-45af-a637-3add40c73f05

📥 Commits

Reviewing files that changed from the base of the PR and between 0857d79 and 981b198.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
fd -HI -t f . | xargs -r rg -n \
  'go-version|golang:[0-9]|^go 1\.|GO_VERSION|GOTOOLCHAIN'

Repository: openshift-online/ocm-cli

Length of output: 801

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- go.mod ---\n'
cat -n go.mod | sed -n '1,40p'

printf '\n--- .github/workflows/check-pull-request.yaml ---\n'
cat -n .github/workflows/check-pull-request.yaml | sed -n '1,140p'

printf '\n--- .github/workflows/publish-release.yaml ---\n'
cat -n .github/workflows/publish-release.yaml | sed -n '1,120p'

Repository: openshift-online/ocm-cli

Length of output: 253

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- go.mod ---'
sed -n '1,40p' go.mod | cat -n

echo
echo '--- .github/workflows/check-pull-request.yaml ---'
sed -n '1,140p' .github/workflows/check-pull-request.yaml | cat -n

echo
echo '--- .github/workflows/publish-release.yaml ---'
sed -n '1,120p' .github/workflows/publish-release.yaml | cat -n

echo
echo '--- other go-version/go pins ---'
rg -n --hidden --glob '!go.sum' --glob '!vendor/**' \
  'go-version:|golang:[0-9]|^go 1\.|GO_VERSION|GOTOOLCHAIN' .

Repository: openshift-online/ocm-cli

Length of output: 9765

---

Bump the Go version pins in CI and release workflows. go.mod now requires Go 1.26.0, but .github/workflows/check-pull-request.yaml still uses 1.25 and .github/workflows/publish-release.yaml still uses 1.23, so those jobs will fail until they’re updated too.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 3, Update the Go version configuration in the
check-pull-request and publish-release workflow definitions to use Go 1.26.0,
matching the version declared by go.mod. Replace the existing 1.25 and 1.23 pins
while leaving the surrounding CI and release steps unchanged.

Source: MCP tools

[openshift-ci]

@dependabot[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images-images	981b198	link	true	/test images-images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

New changes are detected. LGTM label has been removed.

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.