Update devbox (major) #482

renovate · 2025-10-15T18:29:34Z

This PR contains the following updates:

Package	Update	Change
docker	major	`latest` -> `28.5.1`
kustomize	major	`latest` -> `5.8.0`
mockgen	major	`latest` -> `1.6.0`
yq-go	major	`latest` -> `4.48.1`

Release Notes

kubernetes-sigs/kustomize (kustomize)

`v5.8.0`

Highlights

implements to replacements value in the structured data

Now, We can edit yaml/json in yaml manifests with replacements transformer.
See #5679

For example

## source
apiVersion: v1
kind: ConfigMap
metadata:
  name: source-configmap
data:
  HOSTNAME: www.example.com
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: target-configmap
data:
  config.json: |-
    {"config": {
      "id": "42",
      "hostname": "REPLACE_TARGET_HOSTNAME"
    }}

## replacement
replacements:
- source:
    kind: ConfigMap
    name: source-configmap
    fieldPath: data.HOSTNAME
  targets:
  - select:
      kind: ConfigMap
      name: target-configmap
    fieldPaths:
    - data.config\.json.config.hostname

fix: Propagate Namespace correctly to Helm

The long-standing bug where kustomize's namespace transformer did not pass namespaces to helmCharts has been fixed.
See #5940

For example

## define namespace
namespace: any-namespace

helmCharts:
- name: minecraft
  repo: https://kubernetes-charts.storage.googleapis.com
  version: v1.2.0
  # namespace: any-namespace   ## propagates without additional namespace specific
  valuesFile: values.yaml

Feature

#5679: implements to replacements value in the structured data
#5863: Add regex support for Replacement selectors
#5930: feat: add PatchArgs API type to populate patch options

fix

#5940: fix: Propagate Namespace correctly to Helm
#5971: fix: performance recession when propagating namespace to helm
#5942: fix fnplugin storagemounts validation
#5958: fix: make AbsorbAll conflict error more verbose
#5961: refactor: nested format string
#5967: Fix infinite loop in HTTP client by validating URLs before requests
#5985: fix(kyaml/yaml): minor nil safety fix for RNode.Content etc
#5991: Fix duplicate key error when adding multiple labels with --without-selector

Dependencies

#5962: chore: update dependencies from security alert
#5959: update go 1.24.6

chore

#6007: Update kyaml to v0.21.0
#6008: Update cmd/config to v0.21.0
#6009: Update api to v0.21.0

`v5.7.1`

This release introduces code to replace the shlex library used for parsing arguments in the exec plugin.
If any existing manifests become corrupted, please file an issue. discussion: kubernetes/kubernetes#132593 (comment)

Dependencies

#5943: drop shlex dependency

Chore

#5948: Update kyaml to v0.20.1
#5949: Update cmd/config to v0.20.1
#5950: Update api to v0.20.1

`v5.7.0`

Feature

#5630: Add static value source for replacement
#5921: feat: Add images suport for Image Volumes
#5771: fix: Allow patches with empty files with multiple newlines or comments
#5865: feat(helm): allow the use of devel alias for helmcharts

fix

#5846: fix: Get version from the BuildInfo.Main.Version if not found in deps and build flag
#5859: fix: Don't panic on multiple $patch: delete strategic merge patches in a single patch file
#5877: fix: make private one field in replacements transformer struct that had a missing JSON tag

Dependencies

#5847: replace deplecated package github.com/google/shlex with github.com/carapace-sh/carapace-shlex
#5873: Bump to github.com/spf13/viper v1.20.0
#5931: Drop usage of forked copies of goyaml.v2 and goyaml.v3

chore

#5882: Set Git messages to English for TestRemoteLoad_LocalProtocol
#5934: Update kyaml to v0.20.0
#5935: Update cmd/config to v0.20.0
#5936: Update api to v0.20.0

`v5.6.0`

Announce

This release introduces a unified internal package version (v0.19.0) across the entire kustomize repository.
ref. #5800

Chore

#5809: fix: "edit add labels" make labels handle -f flag same as commonLabels

Dependencies

#5825: Update to latest kube-opeapi to drop govalidator dependency
#5830: downgrade go-difflib and go-spew to tagged releases
#5837: Update kyaml to v0.19.0
#5839: Update cmd/config to v0.19.0
#5840: Update api to v0.19.0

`v5.5.0`

Breaking change

A starlark support for krm functions was removed to cleanup dependencies. #5768
This feature was deprecated 3 years ago and removed because there was no desire to continue using it.
#5768 (comment)

Feature

#5751: Add --helm-debug Flag to Kustomize for Enhanced Helm Debugging

Fix Bugs

#5458: Sort built-in Namespace kind before CRDs with the same name
#5745: Add Annotation to Control Inline List Conversion in Kustomize Resources"

Dependencies

#5763: Update go 1.22.7
#5781: Update kyaml to v0.18.1
#5782: Update cmd/config to v0.15.0
#5783: Update api to v0.18.0

`v5.4.3`

Caution

The kustomize localize subcommand(this subcommand is now in the beta stage) now verifies the success of kustomize build when executed.
If you are using the missing manifests, maybe you failed to download them with the localize subcommand. Please use the --no-verify flag to skip validation steps.
#5544: Run kustomize build with kustomize localize and add a no-verify flag.

Fix Bugs

#5682: fix: include label in templates when adding by cli
#5689: Fix sortOptions removal when running edit command

chore

#5506: fix some comments
#5718: fix lint error in kustomizationfile_test.go

Dependencies

#5734: Update kyaml to v0.17.2
#5735: Update cmd/config to v0.14.2
#5736: Update api to v0.17.3

`v5.4.2`

Feature

#5294: feat: localize absolute paths
#5556: feat: support labels key in transformer configuration

chore

#5671: refactor: string in slice is now part of stdlib
#5681: chore: remove unused function
#5688: refactor: function in stdlib now

Dependencies

#5672: chore(deps): bump dependencies of kustomize + sync go workspace
#5680: chore: restore version for github.com/asaskevich/govalidator
#5702: Update kyaml to v0.17.1
#5703: Update cmd/config to v0.14.1
#5704: Update api to v0.17.2

`v5.4.1`

This is a patch of kustomize v5.4.0 and should fix the kustomize version subcommand issues in its assets.

kustomize v5.4.1

#5644: fix version subcommand is not working after release build

kustomize v5.4.0

Breaking changes

#5519: Fix null YAML values being replaced by "null"

kustomize requires Go 1.21 or higher at build

#5567: fix 'golang.org/x/exp/slices' dependencies

Features

#5411: Add --load-restrictor completion
#5467: feat: edit set secret

More better error handling

#5539: Include exec plugin stderr with wrapped error
#5542: fix: improve accumulation failure message
#5550: use Strict unmarshal when read TransformerConfig

Bug fixes/performance improvements

#5234: fix edit set image to parse both tag and digest
#5621: Use require for Error and NoError

Dependencies

#5479: Revert "Switch to json-patch v5"
#5541: Use canonical json-patch v4 import
#5615: update dependencies google.golang.org/protobuf@v1.33.0

update internal Dependencies

#5639: Update kyaml to v0.17.0
#5640: Update cmd/config to v0.14.0
#5641: Update api to v0.17.0

cleanup Dependencies

#5044: Remove non-essential dependency imdario/mergo
#5567: fix 'golang.org/x/exp/slices' dependencies
#5627: Remove klog/v1 dependencies

chore

#5495: chore: move removetest.go to the internal package
#5518: Update owners file
#5622: Pin tool versions with hack/go.mod

`v5.3.0`

#5211: Fix nil pointer dereferencing when converting vars to replacements
#5270: helm: add support for kube-version and add cli args for both kube-version and api-versions
#5391: feat: edit set configmap
#5402: release cleanup, unpin the modules
#5409: refactor: move reusable bits in preparation for new 'edit set' commands
#5412: Use upstream go-yaml fork and remove our internal one
#5421: Replace gopkg.in/yaml.v2 with sigs.k8s.io/yaml/goyaml.v2
#5424: Run go work sync
#5430: fix: handle empty namespace as default
#5454: fix: support namespace flag on edit remove secret/configmap
#5455: fix: flaky ConfigMap/Secret args tests
#5456: chore: rename files to match package pattern
#5475: Update kyaml to v0.16.0
#5476: Update cmd/config to v0.13.0
#5477: Update api to v0.16.0

`v5.2.1`

This is a patch of kustomize v5.2.0 and should fix the directory formatting issues in its assets.

Release notes from v5.2.0 (Delta from v5.1.1)

Currently, Kustomize has already resolved that block on releasing for Windows and Darwin ARM(#5220). Now, We can release those architecture binaries.

New Features for `kustomize build`

patches accept a patch file with multiple patches(#5194)
Add support for OCI based helm repos(#5167)

New Features for `kustomize edit` subcommands

#4486: add: "edit add labels" command adds an option for labels without selector
#5327: feat: add remove configmap command
#5333: Add --no-verify flag to edit add resource command
#5344: feat: add remove secret command
#5367: fix: add namespace option to 'edit add configmap' command

Bug fixes

#5342: Update imdario/mergo to v0.3.13
#5196: fix: patch additions honor source key style

chore

#5345: docs: update remove configmap comment
#5193: [refactor]: Internalize loader api
#5315: refactor: change "add configmap/secret" commands to reuse code and improve tests

Dependency updates

#5254: release cleanup
#5197: Switch to json-patch v5
#5393: Update kyaml to v0.15.0
#5394: Update cmd/config to v0.12.0
#5395: Update api to v0.15.0

`v5.1.1`

Built with go 1.20.6 to address CVEs in previous go versions.

#5245: Fix typo in help for the create subcommand

`v5.1.0`

Kustomize is blocked on releasing for windows and darwin ARM until #5220 is resolved. If you are interested in fixing it, please leave ideas on that issue for how we can resolve it.

Highlights

Components are now applied after generators: #5170

We made this change cautiously as we want to avoid user friction when updating kustomize; however we felt that it is a bug that resources from resources and resources from generators are treated differently. Given that components is currently an alpha feature, we felt that now was the time to adjust if ever.

We are currently working on on #4402, which will make the ordering of resources, components, and other generators customizable in the kustomization file. Please use that issue for tracking if you are blocked from upgrading kustomize for this reason, and we hope to have it available soon.

See #5141 for more detailed discussion.

Bug fixes:

#5030: kustomize edit will return an error if there is no matching path
#5170: components are now applied after generators
#4949: error if kustomization file is empty

Dependency updates

#5186: Update gnostic dependency with gnostic-models
#5187: Bump to go 1.20
#5212: pin to kyaml v0.14.3
#5213: pin to cmd/config v0.11.3
#5214: pin to api 0.14.0

`v5.0.3`

This release reverts the regression with the helm plugin that was introduced in v5.0.2.

Built with go 1.19.9 to remove CVE vulnerabilities.

Changelog

#5164: Revert "Fix using same helm chart with different versions"

`v5.0.2`

Built with go 1.19.9 to resolve CVE vulnerabilities.

Known issues:

#5163: kustomize 5.0.2 breaks helmCharts w/ chartHome. We are in the process of reverting the breaking change and rereleasing kustomize. Users of the helmCharts plugin with local charts are advised to skip this release.

Changelog

#5159: pin to kyaml v0.14.2
#5160: pin to cmd/config v0.11.2
#5161: pin to api 0.13.3

`v4.5.4`

#4538: move to google/gnostic v0.5.7-v3refs (required for kubectl integration update)
#4545: Add more name refs to PodTemplate for ConfigMap and Secret
#4547: Update kyaml to v0.13.6
#4549: Update cmd/config to v0.10.6
#4550: Update api to api/v0.11.4

`v4.5.2`

2f17803 Fix regression: Support for pseudo git HTTP urls in the git cloner had broken in 59c8265 (#4453)
b73dfe7 Remove exclude statements from kustomize module (#4387)

`v4.4.1`

This release restores the Windows binary and introduces ppc64le and s390x binaries.

b6cb6c8 fix build annotations getting lost after applying JSON 6902 patch (#4266)
d8f406d Fix: replacements entries get source and targets with null value appended (#4271)
ef5f1d3 support label and annotation selection in replacement targets (#4229)
ba051c8 fix issue with quote being dropped in configmap generation (#4242)
0d8c107 fix issue with openapi schema from components (#4210)

`v4.4.0`

The headline feature of this release is improved support for YAML anchors and aliases, which will be expanded by default as of this version. (Issue #3675; PRs #4114 and #4187)

Additional features and fixes include:

12c177a fixes 4123; added length check on originalFields of kustomizationFile to prevent panic when kustomization file began with a comment(or a blank line) followed by a document separator

`v4.3.0`

7b5e43d Feature: Add edit set annotation (#4073)
0537b59 support yaml formatted openapi schema (#4017)
1e1b9b4 exec function working dir is the kustomization that referenced it (#4125)
38b2b33 update openapi to v1.21.2, fixing batch/v1 CronJob patching behavior (#4112)
e1804cb Retain field order after running any arbitrary functions on resources (#4021)
78737f5 Updated ByteReader to allow white space and comments on the same line after --- and throw an error if anything else is detected (#4014)
16dcc98 deprecate some cfg commands (#4048 )
3350c72 option for origin data as annotation (#4065)
97e7cb1 remove annotations added by the kyaml reader (#4091)

`v4.2.0`

New experimental command to automatically migrate vars to replacements: kustomize edit fix —vars. For details, run kustomize edit fix -h. Warning: converting vars to replacements will potentially overwrite many resource files and in rare scenarios may not produce the same output when kustomize build is run. We recommend doing this in a clean git repository where the change is easy to undo.

a1746f2 Pin to api v0.8.11
bb6f83f Pin to cmd/config v0.9.13
aa92d83 Pin to kyaml (#4020)
217e5c7 fix openapi command help page
7fae7d1 Move api/filesys to kyaml/filesys (#3997)
c19a972 expose --as-current-user via AddFunctionBasicsFlags
3b37fed convert vars to replacements: mapping value with dot
f121e74 convert vars to replacements
24294d3 upgrade json-patch 4.11.0
a3ed120 Handle errors
f6e6ac0 Back to development mode; unpin the modules

`v4.1.3`

New experimental ReplacementTransformer, docs on the way: kubernetes-sigs/cli-experimental#158 (will end up here )
This will replace the vars feature. Thanks @natasha41575!
Fix for #3705 (use k8s.io/kube-openapi instead of github.com/go-openapi/spec). Thanks @gautierdelorme!
Allow pulls of openapi data from live API servers (openapi fetch command). Thanks @natasha41575!
Remote git urls can specify a timeout parameter. Thanks to @joshdk!
More examples of helm usage.
Speed up cluster-scoped type checks.
API changes towards 1.0
- Gvk and Resid types moved to kyaml
- Resource now inlines RNode rather than delegating to it
- Resmap now accepts an kio.Filter visitor (that can change the ResMap size).

afaf7c6 Pin to api v0.8.10
c24daec Pin to cmd/config v0.9.12
51605be Pin to kyaml v0.10.20
3f3d3b1 Replace pkger with embed.FS compatibility
dca13a4 use assert statements for kustomize edit tests
3cf18ad fix test
2bec25b add new fields to ordered fields
6608472 Simplify gvk, speed up cluster-scoped checks.
a4db686 Unpin everything.
5a8a4d4 More pinning.
1235047 Establish pin state.
1e7260b Pin to cmd/config v0.9.11
3a508da Pin to kyaml/v0.10.18
45fc670 update openapi fetch command
bcbfa06 remove go-openapi/spec,validate,strfmt from kustomize/
38e9c34 Back to dev mode; unpin the modules.

`v4.1.2`

This is a patch release to downgrade a dependency on github.com/imdario/mergo from v0.3.7 to v0.3.5.
This is to avoid forcing downstream kubernetes to use a newer version of mergo than it currently has.

End users of the CLI can stay with v4.1.0. See that release for user-facing changes.

3f2b98f Pin to api v0.8.8
5ba45f1 Back to mergo v0.3.5
d8015d3 Back to development mode; unpin the modules

uber-go/mock (mockgen)

`v0.6.0`

Added

#258: Archive mode: a new mockgen mode that generates mocks out of archive files.
#262: Support for specifying mock names when using the _gomock_archive bazel rule.

Fixed

#276: Fixed mockgen errors with go1.25 due to outdated golang.org/x/tools dependency.

`v0.5.2`

Fixed

#248: Fixed an issue with type aliases not being included in generated code correctly.

`v0.5.1`

Fixed

#220: Package mode will now generate code that uses aliases of types
when they are used in the source.
#219: Fixed a collision between function argument names and package names
in generated code.
#165: Fixed an issue where aliases specified by -imports were not being
respected in generated code.

Thanks to @mtoader and @bstncartwright for their contributions to this release.

`v0.5.0`

Added

#153: Add --write_command_comment flag to specify whether to include
Generated by this command comment.
#191: Add --build_constraint flag to add //go:build directives
to generated mocks
#214: Add gob mode to support custom package loading techniques in place
of --exec_only

Changed

#181: Made mockgen faster by changing flags passed to go list.
#183: Made Cond matcher generic.
#204: Removed ISGOMOCK() from generated mocks.
#207: Deprecated reflect mode and replaced it with the new package mode.

Fixed

#144: Fix a deadlock that can happen when mocking an interface that
matches fmt.Stringer.
#168: Fix an issue where the "generated by" comment was being included
in the package comment of generated mocks.

Thanks to @tulzke @JacobOaks @ARR4N @sashamelentyev @sywhang @fasmat
@eyasy1217 @ghouscht @tie @Neo2308 @carson-brill @alexandear @sodul
@nbgraham for their contributions this release.

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

codecov · 2025-10-15T18:32:38Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.72%. Comparing base (8ac8b75) to head (c83fddb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #482   +/-   ##
=======================================
  Coverage   73.72%   73.72%           
=======================================
  Files          19       19           
  Lines        2835     2835           
=======================================
  Hits         2090     2090           
  Misses        504      504           
  Partials      241      241

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

renovate bot added the dependencies dependency updates including security fixes label Oct 15, 2025

renovate bot temporarily deployed to prod October 15, 2025 18:29 Inactive

renovate bot force-pushed the renovate/major-devbox branch from c3600c3 to 1648376 Compare October 15, 2025 20:42

renovate bot temporarily deployed to prod October 15, 2025 20:43 Inactive

renovate bot had a problem deploying to prod October 15, 2025 20:43 Failure

renovate bot force-pushed the renovate/major-devbox branch from 1648376 to 17fc49c Compare November 4, 2025 00:41

renovate bot temporarily deployed to prod November 4, 2025 00:42 Inactive

Update devbox

c83fddb

renovate bot force-pushed the renovate/major-devbox branch from 17fc49c to c83fddb Compare November 13, 2025 18:40

renovate bot had a problem deploying to prod November 13, 2025 18:41 Failure

renovate bot temporarily deployed to prod November 13, 2025 18:41 Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update devbox (major) #482

Update devbox (major) #482

Uh oh!

renovate bot commented Oct 15, 2025 •

edited

Loading

Uh oh!

codecov bot commented Oct 15, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Update devbox (major) #482

Are you sure you want to change the base?

Update devbox (major) #482

Uh oh!

Conversation

renovate bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Highlights

implements to replacements value in the structured data

For example

fix: Propagate Namespace correctly to Helm

For example

Feature

fix

Dependencies

chore

Dependencies

Chore

Feature

fix

Dependencies

chore

Announce

Chore

Dependencies

Breaking change

Feature

Fix Bugs

Dependencies

Caution

Fix Bugs

chore

Dependencies

Feature

chore

Dependencies

kustomize v5.4.1

kustomize v5.4.0

Breaking changes

kustomize requires Go 1.21 or higher at build

Features

More better error handling

Bug fixes/performance improvements

Dependencies

update internal Dependencies

cleanup Dependencies

chore

Release notes from v5.2.0 (Delta from v5.1.1)

New Features for kustomize build

New Features for kustomize edit subcommands

Bug fixes

chore

Dependency updates

Highlights

Bug fixes:

Dependency updates

Changelog

Known issues:

Changelog

Added

Fixed

Fixed

Fixed

Added

Changed

Fixed

Configuration

Uh oh!

codecov bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

renovate bot commented Oct 15, 2025 •

edited

Loading

New Features for `kustomize build`

New Features for `kustomize edit` subcommands

codecov bot commented Oct 15, 2025 •

edited

Loading