Skip to content
This repository was archived by the owner on Nov 10, 2026. It is now read-only.

fix(deps): update go modules (minor and patch) - #33

Merged
ecv merged 1 commit into
mainfrom
renovate/go-modules-minor-patch
Nov 3, 2026
Merged

fix(deps): update go modules (minor and patch)#33
ecv merged 1 commit into
mainfrom
renovate/go-modules-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
go.datum.net/datumctl v0.15.0 → v0.23.3 age confidence
go.miloapis.com/inventory v0.1.0 → v0.2.3 age confidence
k8s.io/apimachinery v0.37.1 → v0.37.2 age confidence
k8s.io/client-go v0.37.1 → v0.37.2 age confidence

Release Notes

datum-cloud/datumctl (go.datum.net/datumctl)

v0.23.3

Compare Source

What's Changed

Full Changelog: datum-cloud/datumctl@v0.23.2...v0.23.3

v0.23.2

Compare Source

What's Changed

  • chore(deps): update module golang.org/x/net to v0.60.0 [security] by @​renovate[bot] in #​314

Full Changelog: datum-cloud/datumctl@v0.23.1...v0.23.2

v0.23.1

Compare Source

What's Changed

Full Changelog: datum-cloud/datumctl@v0.23.0...v0.23.1

v0.23.0

Compare Source

Change a single field, annotation, or label on a live resource in one command, plus clearer delete and diff output.

What's new

  • Patch, annotate, and label — datumctl patch, annotate, and label change one field, annotation, or label on a live resource without re-applying a full manifest. patch defaults to a JSON merge patch. (#​321)
  • Delete shows its scope — delete now shows which project or organization it will act on before it runs. (#​322)
  • Readable diff output — diff shows resource names instead of temporary file paths. (#​325)
  • Global flags before plugin names — global flags are now accepted before a plugin name. (#​326)
  • Service-account login for CI — the docs now make service-account login easier to find for CI use. (#​323)
  • Third-party licenses — a NOTICE file lists third-party licenses and ships with each release. (#​297, #​330)
  • Security toolchain update — the Go toolchain is now v1.26.9, and the Nix build is repaired after the dependency bump. (#​311, #​333)

v0.22.0

Compare Source

Upgrade every installed plugin in one command.

What's new

  • Upgrade all plugins — datumctl plugin upgrade --all upgrades every installed plugin instead of one at a time. (#​313)

v0.21.0

Compare Source

What's Changed

Full Changelog: datum-cloud/datumctl@v0.20.1...v0.21.0

v0.20.1

Compare Source

What's Changed

New Contributors

Full Changelog: datum-cloud/datumctl@v0.20.0...v0.20.1

v0.20.0

Compare Source

Plugins now use the account you switch to, and plugin authors get a helper that builds the Datum Cloud API address for them.

What's new

  • Plugins follow datumctl auth switch. Plugin commands, datumctl auth get-token and datumctl docs openapi now act as the account you switched to rather than the one you last logged in with, which fixes Unauthorized errors from plugins after a switch. (#​293, #​295)
  • API address helper for plugin authors. The plugin SDK's ControlPlaneURL() builds the project or organization API address from the values datumctl passes to plugins, and names the missing value when it can't. (#​271)

v0.19.0

Compare Source

The built-in AI agent is gone. Patch now runs as a plugin on your Datum Cloud login, so you no longer need a personal model API key.

What's new

  • Patch runs as a plugin. datumctl ai now runs datumctl assistant and passes flags and subcommands through unchanged; if the plugin is missing, it offers to install it. (#​290)
  • No more personal API keys. The old agent needed your own Anthropic, OpenAI or Gemini key; the plugin uses the hosted assistant service instead. (#​290)
  • Console chat pane removed. Use datumctl assistant for chat; conversations are now stored by the service and follow you between machines. (#​290)

[!NOTE]
Nothing reads your old provider key any more, but it is still on disk and is a live credential. Delete it with rm ~/.config/datumctl/ai.yaml (Linux and macOS) or del %AppData%\datumctl\ai.yaml (Windows). Chats held in the console were saved to ~/.datumctl/conversations and do not carry over.

v0.18.3

Compare Source

Patches five disclosed CVEs in transitive Go dependencies. No application
code changes in this release.

What's new

  • golang.org/x/mod CVE fix — patches two sumdb transparency-log
    verification bypasses (CVE-2026-56865, CVE-2026-56864) that let a malicious
    GOPROXY/GOSUMDB serve unverified module content.
    (#​287)
  • golang.org/x/text CVE fix — patches an infinite loop in Unicode
    normalization triggered by invalid UTF-8 input (CVE-2026-56852).
    (#​286)
  • golang.org/x/net CVE fixes — patches a Punycode hostname validation
    bypass usable for privilege escalation (CVE-2026-39821) and a parser panic
    on invalid SVCB/HTTPS DNS records (CVE-2026-46600).
    (#​285)
  • go.opentelemetry.io/otel CVE fix — patches unbounded baggage header
    parsing (CVE-2026-41178).
    (#​284)
  • Go toolchain bump — updates the toolchain directive to 1.26.6.
    (#​283)
  • Dependency update policy — renovate now follows the shared org policy:
    routine updates wait for approval via the dependency dashboard, while
    security fixes still open automatically.
    (#​282)

v0.18.2

Compare Source

What's Changed

Full Changelog: datum-cloud/datumctl@v0.18.1...v0.18.2

v0.18.1

Compare Source

Fixes an interactive-picker bug that made datumctl login unusable on Windows.

What's new

  • Windows picker input fix — arrow keys now work in the context picker shown after datumctl login on Windows. A background reader watching for ^D couldn't be interrupted on Windows console handles, so it kept holding the terminal in line-input mode and ate the picker's keystrokes. The watcher now detects when it can't be interrupted and skips watching, so login on Windows cancels via ^C only. Unix behavior is unchanged. (#​267)

v0.18.0

Compare Source

A new datumctl api proxy command gives you a local authenticated gateway to the Datum Cloud API — point any tool at localhost and it talks to the platform with zero token plumbing.

What's new

  • datumctl api proxy — starts a loopback proxy that injects your session credentials on every request and refreshes them transparently, so a dev server, test harness, or curl can talk to the Datum Cloud API without ever handling a token. Supports --project/--organization scoping to a single control plane, passes through Kubernetes-style watches and SSE unbuffered, and binds to 127.0.0.1 only with Host-header validation against DNS rebinding. See docs/api-proxy.md. (#​247)

Full Changelog: datum-cloud/datumctl@v0.17.4...v0.18.0

v0.17.4

Compare Source

What's Changed

  • fix: honor ^C during interactive login waits by @​ecv in #​252
  • fix: quit login gracefully on ^D (EOF) during auth waits by @​ecv in #​253

Full Changelog: datum-cloud/datumctl@v0.17.3...v0.18.0

v0.17.3

Compare Source

What's Changed

New Contributors

Full Changelog: datum-cloud/datumctl@v0.17.2...v0.17.3

v0.17.2

Compare Source

What's Changed

Full Changelog: datum-cloud/datumctl@v0.17.1...v0.17.2

v0.17.1

Compare Source

Changelog

  • 8c60a31 Merge pull request #​241 from datum-cloud/fix/trusted-plugin-flag-passthrough
  • 83cf617 Merge pull request #​244 from datum-cloud/fix/auth-help-stale-login-examples
  • 98ab9f9 fix(plugindispatch): forward args verbatim to trusted PATH plugins
  • 50e6d44 fix: correct stale 'datumctl auth login' references

v0.17.0

Compare Source

Signing in to two Datum Cloud environments with the same email address used to silently corrupt your login — this release fixes the root cause, heals existing installs automatically, and makes datumctl auth switch show you exactly which account you're on.

Fixed: logging in to two environments no longer breaks each other (#​237)

Signing in to production and staging with the same email stored both logins under one credential slot, so the second sign-in silently overwrote the first. datumctl auth list still showed both accounts, but after datumctl auth switch the CLI would send one environment's token to the other's API and fail with:

error: You must be logged in to the server (the server has asked for the client to provide credentials)

Logins are now kept separate per environment, so switching accounts, automatic token refresh, and logout all stay scoped to the right one.

Existing installs heal themselves the next time they authenticate — no manual steps, and the migration never deletes a token it can't first preserve.

[!NOTE]
If your login was already overwritten before upgrading, that one token is unrecoverable. Run datumctl login --hostname <that environment's auth host> once to re-establish it; every other environment keeps working without any action.

datumctl auth switch now shows your active account (#​237)

The account you're currently signed in as is labeled (active) in the picker, and the picker now opens on it — so it's always clear what you're switching from:

Which login session?
> swells@datum.net  (api.staging.env.datum.net)  (active)
  swells@datum.net  (api.datum.net)

Full Changelog: datum-cloud/datumctl@v0.16.0...v0.17.0

v0.16.0

Compare Source

The plugin system just got its ecosystem. In v0.15.0 you could install plugins from a single Datum-operated catalog. Now anyone — a community author, an open-source project, or an enterprise platform team — can publish their own catalog, and you can register, search, browse, and install across all of them through the same commands you already know. The curated datum catalog stays the trusted, zero-configuration default, so nothing changes if you never add one.

New: register third-party catalogs (datumctl plugin index) (#​224)

Plugins can now come from more than one place. Add a community or internal catalog with a single command — and an explicit one-time trust decision so you always know what you're opting into.

datumctl plugin index add acme https://plugins.acme.example/index.yaml
datumctl plugin index list
New: search and install across every catalog (#​224)

search and install now span every registered catalog at once, with clear official vs. third-party badges wherever a plugin appears — provenance is never ambiguous. Pin a specific release from any catalog when you need to.

datumctl plugin search dns
datumctl plugin install dns
New: interactive marketplace browser (datumctl plugin browse) (#​224)

Prefer to explore? datumctl plugin browse opens an interactive view across all catalogs, each result clearly badged by source.

For enterprises (#​224)

Private internal catalogs are first-class. A new datumctl plugin validate command lets authors check a manifest before publishing, and allow-list guardrails let platform teams scope which publishers are permitted — down to individual GitHub owners or repositories — with the policy re-enforced continuously, not just at the moment a catalog is added.

[!NOTE]
Third-party plugins run with your Datum credentials, so provenance, the one-time trust decision, and credential handling all got a careful security pass. The curated datum catalog remains the trusted, zero-setup default.

Docs
  • Homebrew install note — the install guide now includes the brew trust step needed by newer Homebrew versions (#​215).

Full Changelog: datum-cloud/datumctl@v0.15.2...v0.16.0

v0.15.2

Compare Source

What's Changed

  • feat: add --exec-interactive-mode to auth update-kubeconfig by @​ecv in #​221

New Contributors

Full Changelog: datum-cloud/datumctl@v0.15.1...v0.15.2

v0.15.1

Compare Source

What's Changed

New Contributors

Full Changelog: datum-cloud/datumctl@v0.15.0...v0.15.1

milo-os/inventory (go.miloapis.com/inventory)

v0.2.3

Compare Source

What's Changed

Full Changelog: milo-os/inventory@v0.2.2...v0.2.3

Changelog

v0.2.2

Compare Source

What's Changed

  • chore(deps): update module github.com/klauspost/compress to v1.18.7 [security] by @​renovate[bot] in #​64
  • chore(deps): update module golang.org/x/text to v0.41.0 [security] by @​renovate[bot] in #​67
  • chore(deps): update module golang.org/x/mod to v0.40.0 [security] by @​renovate[bot] in #​65
  • fix(deps): update module github.com/google/cel-go to v0.30.0 [security] by @​renovate[bot] in #​68
  • fix: Build on Go 1.26 and patch the x/net advisory by @​ecv in #​71

New Contributors

Full Changelog: milo-os/inventory@v0.2.1...v0.2.2

Changelog

  • 559ce80 Merge pull request #​64 from milo-os/renovate/go-github.com-klauspost-compress-vulnerability
  • f44d6c8 Merge pull request #​65 from milo-os/renovate/go-golang.org-x-mod-vulnerability
  • d37c6e4 Merge pull request #​67 from milo-os/renovate/go-golang.org-x-text-vulnerability
  • c996945 Merge pull request #​68 from milo-os/renovate/go-github.com-google-cel-go-vulnerability
  • 1de0ca3 Merge pull request #​71 from milo-os/chore/go-1.26-security-bumps
  • 2808861 chore(deps): update module github.com/klauspost/compress to v1.18.7 [security]
  • 2f4ab28 chore(deps): update module golang.org/x/mod to v0.40.0 [security]
  • 00d3a66 chore(deps): update module golang.org/x/text to v0.41.0 [security]
  • 188278e fix(deps): update module github.com/google/cel-go to v0.30.0 [security]
  • ced70d6 fix: Build on Go 1.26 and patch the x/net advisory

v0.2.1

Compare Source

The inventory controller keeps its leader lease under API load, and activity and status permissions are tighter.

What's new

  • Leader lease renews on its own connection. Lease renewals use a dedicated client with their own rate limit, so a busy controller no longer loses leadership and restarts when the API server is slow. (#​63)
  • Status updates stay with the controller. Editing inventory no longer grants permission to write controller status. (#​62)
  • Activity policies skip rejected and dry-run requests. (#​61)

Full Changelog: milo-os/inventory@v0.2.0...v0.2.1

Changelog

  • 260427b Merge pull request #​61 from milo-os/fix/activity-policy-outcome-guards
  • 2dc2441 Merge pull request #​62 from milo-os/codex/customer-status-permissions
  • 511b7f5 Merge pull request #​63 from milo-os/fix/leader-lease-renewal
  • a1a1581 Separate inventory editing from controller status updates
  • 88525bb fix: Keep the leader lease renewing under API load
  • 2d8b577 fix: skip rejected and dry-run requests in activity policies

v0.2.0

Compare Source

Restores datumctl inventory to the v1alpha1 API and ships the plugin from this repository.

The fix

datumctl inventory get Site returned No matching inventory found. The plugin lived in datum-cloud/inventory and had been reworked to speak graph.inventory.miloapis.com/v1alpha2 — an API group that has never held a single object — while inventory.miloapis.com/v1alpha1 serves 173 live records.

The plugin now lives here, speaks v1alpha1, and is released from this repository's tags following the milo-os convention (milo-os/ipam, milo-os/search).

Install

datumctl plugin install inventory
datumctl inventory get sites

The catalog entry (milo-os/cli-plugins, plugins/inventory.yaml) is updated by this release.

Plugin

  • All 12 inventory kinds for both read and apply: Provider, Region, Site, Rack, Cluster, Node, NetworkDevice, VirtualMachine, Port, Cable, Link, Circuit
  • get <KIND> accepts singular or plural, case-insensitively — get sites, get Site, get vm
  • kinds lists supported kinds, their aliases, and which support apply
  • apply orders a mixed manifest so a referent is admitted before its dependant — Rack before placements, Port before Cable, Cable before Link
  • Per-kind filters: --site, --cluster, --rack, --device, --port, --host, --provider, --type
  • summary counts all twelve
  • Plugin binary is milo-inventory, released separately from the operator's container image and kustomize bundle

Operator

No API or CRD changes. Nothing under config/ or api/ was touched, so the shipped CRD set is unchanged.

Closes #​42, #​51, #​52, #​58, #​59. Part of #​50.

Changelog

  • fd1bc25 Merge pull request #​57 from milo-os/feat/datumctl-inventory-plugin
  • 4da0600 Merge pull request #​60 from milo-os/worktree-plugin-kinds-coverage
  • 0945fd4 feat(plugin): add 'datumctl inventory kinds'
  • c379a5c feat(plugin): cover the remaining 7 inventory kinds
  • cf4a07b feat: ship the datumctl inventory plugin from this repo

v0.1.3

Compare Source

What's Changed

Full Changelog: milo-os/inventory@v0.1.2...v0.1.3

v0.1.2

Compare Source

What's Changed

  • fix(milo-integration): stop shipping ActivityPolicies to infra clusters by @​scotwells in #​46

Full Changelog: milo-os/inventory@v0.1.1...v0.1.2

v0.1.1

Compare Source

What's Changed

  • feat: add Milo IAM for graph.inventory.miloapis.com (v1alpha2) by @​ecv in #​45

Full Changelog: milo-os/inventory@v0.1.0...v0.1.1

kubernetes/apimachinery (k8s.io/apimachinery)

v0.37.2

Compare Source

kubernetes/client-go (k8s.io/client-go)

v0.37.2

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Nov 3, 2026
@renovate
renovate Bot requested a review from a team as a code owner November 3, 2026 02:28
@renovate

renovate Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
github.com/go-logr/logr v1.4.3 -> v1.4.4
k8s.io/api v0.37.1 -> v0.37.2

@ecv
ecv merged commit 137a1ef into main Nov 3, 2026
2 checks passed
@ecv
ecv deleted the renovate/go-modules-minor-patch branch November 3, 2026 02:31
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

1 more reviewer
@ecv ecv ecv approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ecv