chore(deps): update dependency kubernetes-sigs/kustomize to v5.8.3

[scality-renovate]

This PR contains the following updates:

Package	Update	Change
kubernetes-sigs/kustomize	patch	v5.8.1 → v5.8.3

---

Release Notes

kubernetes-sigs/kustomize

v5.8.3

Compare Source

This release eliminates dependencies and compressed blobs that were an issue when bumping kustomize-in-kubectl.
No functional changes in kustomize.

chore

#​6310: chore: bump to Go 1.27 and latest kube-openapi
#​6318: Update kyaml to v0.21.3
#​6320: Update cmd/config to v0.21.3
#​6321: Update api to v0.21.3

v5.8.2

Compare Source

Introduction

In this release, we implemented refactoring to update dependencies and add new features.

This release adds the kustomize edit add configuration and kustomize edit remove component commands. #​6037 #​6083
The built-in OpenAPI schema is now loaded from a pre-compiled bundle embedded in the binary. #​6190
The schema itself is still based on Kubernetes v1.21.2, so the output of kustomize build is not expected to change. If you notice any difference, please file an issue.

Feature

#​6037: feat: add support for 'kustomize edit add configuration' command
#​6083: Add kustomize edit remove component command

fix

#​6263: fix: report an error when the fetched openapi schema is not JSON

Dependencies

#​6075: update go 1.25.7
#​6078: bump go-git and x/crypt
#​6085: update otel lib to v1.40.0
#​6134: drop 'go-spew' dependencies and update dependencies
#​6138: bump k8s.io/kube-openapi, drop github.com/mailru/easyjson
#​6186: bump/go v1.26.5
#​6187: update vuln dependencies at 2026/07
#​6236: chore: bump stretch/testify pkg to remove old yaml dependencies
#​6248: build(deps): bump golang.org/x/text from 0.38.0 to 0.41.0
#​6249: build(deps): bump go.yaml.in/yaml/v2 from 2.4.2 to 2.4.4
#​6251: build(deps): bump github.com/go-errors/errors from 1.4.2 to 1.5.1
#​6254: build(deps): bump github.com/google/gnostic-models from 0.7.0 to 0.7.1
#​6255: build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12
#​6256: build(deps): bump golang.org/x/sys from 0.45.0 to 0.47.0
#​6266: build(deps): bump golang.org/x/text from 0.41.0 to 0.42.0
#​6267: build(deps): bump golang.org/x/sys from 0.47.0 to 0.48.0
#​6273: bump go-git, kin-openapi and k8s.io

chore

#​6190: chore: refactor read scheme to openapi from kubernetes api definition
#​6274: build: use the golangci-lint v2 with release binary
#​6305: Update kyaml to v0.21.2
#​6306: Update cmd/config to v0.21.2
#​6307: Update api to v0.21.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: v5.8.1 to v5.8.2 (patch)
Semver bump type: patch

Changes:

• New CLI commands: kustomize edit add configuration and kustomize edit remove component (additive, not used by this project)
• OpenAPI schema loading refactored to use a pre-compiled bundle; output of kustomize build is not expected to change
• Bug fix: error reporting when fetched OpenAPI schema is not JSON
• Numerous dependency bumps within kustomize (go-git, x/crypto, x/text, protobuf, etc.)

Breaking changes: None

Security concerns: None -- internal dependency bumps in kustomize (go-git, x/crypto) are positive from a security standpoint

Impact on codebase: Kustomize is a build/deploy-time CLI tool only. The two changed files bump the version string in Makefile (line 199: KUSTOMIZE_VERSION) and .devcontainer/Dockerfile (line 37: KUSTOMIZE_VERSION). No Go library imports, no runtime code affected. The config/ kustomization files are processed identically -- the release notes explicitly state no change in kustomize build output.

Recommendation: SAFE TO MERGE (once CI is green)

Notes: CI checks (build, lint, test, test-e2e, generate) are still in progress at time of evaluation. Merge only after all required checks pass. PR authored by scality-renovate[bot] -- posting comment instead of approving per policy.

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: v5.8.1 → v5.8.3 (patch)
Semver bump type: patch (two intermediate releases: v5.8.2 and v5.8.3)

Changes:

• v5.8.3: No functional changes — dependency cleanup for kustomize-in-kubectl, Go 1.27 bump
• v5.8.2: New additive CLI commands (kustomize edit add configuration, kustomize edit remove component), OpenAPI schema loading refactored to pre-compiled bundle (same schema version, no output change expected), dependency updates including security fixes (go-git, x/crypt, vuln dependencies)

Breaking changes: None

Security concerns: None — the bump includes positive security improvements (updated go-git, x/crypt, and vulnerability-related dependency updates from 2026/07)

Impact on codebase: None. Kustomize is a dev/deploy CLI tool, not a compiled dependency. The PR only changes the version pin in .devcontainer/Dockerfile and Makefile. The config/ kustomize manifests are inputs to kustomize and are unaffected by this version bump.

CI status: build and generate passed; lint, test, and test-e2e are still in progress.

Recommendation: SAFE TO MERGE (once CI is green)

Notes: Pure tooling version bump with no runtime impact. v5.8.3 release notes explicitly state "No functional changes in kustomize."

— Claude Code

[anthony-treuillier-scality]

merge is blocked, requires go 1.27+

[anthony-treuillier-scality]

merge is blocked, requires go 1.27+