[dependabot]

Bumps the kubernetes group with 11 updates in the / directory:

Package	From	To
k8s.io/apiextensions-apiserver	0.35.8	0.37.1
k8s.io/apimachinery	0.35.8	0.37.1
k8s.io/client-go	0.35.8	0.37.1
k8s.io/component-helpers	0.35.8	0.37.1
k8s.io/kubectl	0.35.8	0.37.1
k8s.io/metrics	0.35.8	0.37.1
k8s.io/utils	0.0.0-20260210185600-b8788abfbbc2	0.0.0-20260626114624-be93311217bd
sigs.k8s.io/cloud-provider-azure	1.35.9	1.37.2
sigs.k8s.io/cloud-provider-azure/pkg/azclient	0.19.0	0.21.0
sigs.k8s.io/cluster-inventory-api	0.1.3	0.2.0
sigs.k8s.io/controller-runtime	0.23.3	0.25.2

Updates k8s.io/apiextensions-apiserver from 0.35.8 to 0.37.1

Commits

• 4cf2f06 Update dependencies to v0.37.1 tag
• 29d19cf Fix unit test compile failure under the fieldsv1string build tag
• 1aa2717 Merge pull request #140205 from pohly/cel-deps
• b51744f dependencies: cel-go v0.29.2
• f416935 Merge pull request #140782 from dims/update-kube-openapi
• 19c0db2 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
• 8ed17b6 Merge pull request #140774 from dims/prom-client-v1.24.0
• 48a6e2f Update prometheus/client_golang to 1.24.0
• e7c1b62 Merge pull request #139821 from pohly/client-go-informers-type-safety
• e86edad Merge pull request #140740 from dims/update-grpc-1.82.1
• Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.35.8 to 0.37.1

Commits

• e3a4b17 Update dependencies to v0.37.1 tag
• e55f9ba feat(api): Update node restriction admission to use new API
• cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis
• 97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api
• f21afab Add validation for camelcase in reason field
• d7ad413 Merge pull request #140782 from dims/update-kube-openapi
• e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist
• 464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
• 0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key
• 95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...
• Additional commits viewable in compare view

Updates k8s.io/client-go from 0.35.8 to 0.37.1

Commits

• 066ed4e Update dependencies to v0.37.1 tag
• 50c6f9b metrics: Register: Fix incorrect assignment
• 49f0a7b Merge pull request #140931 from pohly/client-go-changelog-adding-apigroups
• 74d4b1e Merge pull request #140966 from alancaldelas/client-go-fakecustomstore-store
• 2bf14f2 Merge pull request #140990 from xigang/revert-140448
• 7b892fe Revert "Merge pull request #140448 from xigang/event_broadcaster_goroutine_leak"
• df92378 Merge pull request #140334 from nojnhuh/dra-workloadresourceclaims-beta
• 45a0ff1 client-go: restore FakeCustomStore conformance to cache.Store
• 9d3b531 Merge pull request #139795 from omeryahud/worktree-kep-5963-device-compat-groups
• 694f4eb apidiff: ignore adding entirely new API groups
• Additional commits viewable in compare view

Updates k8s.io/component-helpers from 0.35.8 to 0.37.1

Commits

• cc6337f Update dependencies to v0.37.1 tag
• f61c661 nodedeclaredfeatures: register DRAOptionalNodeOperations feature
• 4f5e8ec Merge pull request #140013 from nispriha/njagan/bind_options
• 7eac901 Add Node Declared Features integration for VolumeBindMountOptions
• 6603a59 Merge pull request #140009 from pravk03/native-dra-alpha2
• e7b6501 fix(component-helpers): skip DRA values in AggregateContainerLimits if limits...
• 7579830 feat(admission/ndf): validate that NodeAllocatableDRA feature is supported by...
• c6c29b0 feat(component-helpers): consider DRA during resource computation during resize
• 55fb147 feat(component-helper): add DRA status allocations in AggregateContainerLimits
• f1e92fd feat(sched): allow pods with node-allocatable claims not referenced by any co...
• Additional commits viewable in compare view

Updates k8s.io/kubectl from 0.35.8 to 0.37.1

Commits

• 724ca97 Update dependencies to v0.37.1 tag
• ed0c0fd Merge remote-tracking branch 'origin/master' into release-1.37
• 2c20d3d Fix windows backslash escaping (#141296)
• 560f99f Feat: kubectl top support v1.metrics.k8s.io (#139726)
• 700815a Merge pull request #140782 from dims/update-kube-openapi
• 75b8cbc Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
• 087ff30 Merge pull request #140774 from dims/prom-client-v1.24.0
• 9f603d6 Update prometheus/client_golang to 1.24.0
• 2953abc Merge pull request #140740 from dims/update-grpc-1.82.1
• 110a229 Update google.golang.org/grpc to v1.82.1
• Additional commits viewable in compare view

Updates k8s.io/metrics from 0.35.8 to 0.37.1

Commits

• 0dbb5b9 Update dependencies to v0.37.1 tag
• cf3eab3 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
• 7b3a978 Merge pull request #139223 from tico88612/feat/v1-metrics-k8s-io
• e6be224 KEP-5207: Promote metrics.k8s.io to GA
• 2c15526 Merge pull request #140385 from dims/update-cadvisor-v0.60.4
• f8b7ddb bump github.com/google/cadvisor/lib from v0.60.3 to v0.60.4
• 969567d Merge pull request #140337 from liggitt/ttrpc
• b3888a4 Bump github.com/containerd/ttrpc to v1.2.9
• 5e2495a Merge pull request #140294 from jpbetz/revert-smd-306
• 80b47c2 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.4.2
• Additional commits viewable in compare view

Updates k8s.io/utils from 0.0.0-20260210185600-b8788abfbbc2 to 0.0.0-20260626114624-be93311217bd

Commits

• See full diff in compare view

Updates sigs.k8s.io/cloud-provider-azure from 1.35.9 to 1.37.2

Release notes

Sourced from sigs.k8s.io/cloud-provider-azure's releases.

v1.37.2

Full Changelog: v1.37.1..v1.37.2

Changes by Kind

Bug or Regression

• Reverted to Go 1.26 to mitigate TLS connection resets affecting authentication and Kubernetes API requests in environments with incompatible egress firewalls or network appliances. (#11210, @​anndono)

Dependencies

Added

Nothing has changed.

Changed

• github.com/Azure/azure-sdk-for-go/sdk/azcore: v1.23.2 → v1.23.3
• github.com/Azure/azure-sdk-for-go/sdk/azidentity: v1.14.1 → v1.15.0
• github.com/Azure/azure-sdk-for-go/sdk/internal: v1.12.0 → v1.13.0
• github.com/AzureAD/microsoft-authentication-library-for-go: 63dcc2d → v1.10.1
• github.com/klauspost/compress: v1.19.1 → v1.20.1
• github.com/prometheus/client_golang: v1.24.1 → v1.25.0
• golang.org/x/sync: v0.23.0 → v0.24.0
• golang.org/x/sys: v0.48.0 → v0.49.0
• golang.org/x/text: v0.42.0 → v0.43.0
• golang.org/x/tools: v0.49.0 → v0.51.0

Removed

Nothing has changed.

v1.37.1

Full Changelog: v1.37.0..v1.37.1

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• [BREAKING CHANGE] Load balancer reconciliation now validates public IP resource group annotations, internal subnet annotations for internal Services, and, when Private Link Service is requested, its resource group, name, and subnet annotations against Azure's documented naming rules. Surrounding whitespace in subnet annotation values is trimmed. correct annotation values that do not meet these rules. Affected Services will fail create/update reconciliation until corrected. (#11044, @​Liunardy)
• [BREAKING CHANGE] fix: reject LoadBalancer Services that list a managed load balancer frontend IP in the service.beta.kubernetes.io/azure-additional-public-ips annotation. The annotation remains supported for IPs outside managed frontends, such as Azure Global-tier public IPs. remove managed frontend IPs from this annotation. (#11087, @​Liunardy)

Changes by Kind

Bug or Regression

• Fix health-probe-proxy rejecting HTTP health probes without a PROXY header after the go-proxyproto dependency upgrade. Restore support for both headerless and PROXY-protocol requests. (#11139, @​anndono)
• Fix: keep the deny-all NSG rule intact for Services using azure-deny-all-except-load-balancer-source-ranges when another Service sharing one of its destinations is reconciled or deleted. Previously that destination could be dropped from the rule, leaving the Service reachable from anywhere in the virtual network rather than only its configured source ranges. fix: stop adding NSG rules for an IP family the Service does not serve. A single-stack Service with the floating IP disabled no longer gets rules for the other family's node addresses, and any such rule already in the security group is removed the next time the Service is reconciled. (#11098, @​Liunardy)
• Fix: preserve full registry hostnames in the ACR credential provider's cloud-suffix fallback. (#11086, @​Liunardy)

Dependencies

... (truncated)

Commits

• 6e6e09b build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#11198)
• 026f8a5 build(deps): bump oss/go/microsoft/golang from 71a8dd7 to 216bcfa (#11212)
• 02de6a2 chore: use Go 1.26 across all modules and Docker builds (#11210)
• efc1969 build(deps): bump the all group with 4 updates (#11208)
• 96ede5c build(deps): bump the all group with 5 updates (#11175)
• d707906 build(deps): bump oss/go/microsoft/golang (#11174)
• 38a23d6 build(deps): bump the all group with 5 updates (#11176)
• d6da63f [release-1.37] chore: bump Go dependencies for reported CVEs (#11144)
• 15afdc5 [release-1.37] fix: restore optional PROXY headers in health-probe-proxy (#11...
• ff0a274 build(deps): bump oss/go/microsoft/golang from 153d748 to 92e9908 (#11117)
• Additional commits viewable in compare view

Updates sigs.k8s.io/cloud-provider-azure/pkg/azclient from 0.19.0 to 0.21.0

Commits

• 1d13d71 feat(azclient): add ThrottleError type with RetryAfter field (#10557)
• 3f57aa4 chore(e2e): add ipv6 and dual stack cluster templates (#10541)
• 59411dd docs: add dependabot unblocker automation prompt (#10555)
• 7364d0b feat(skill): add debug-e2e-pipeline skill (#10489)
• 6277fa1 fix: getServicePIPName returns empty for IPv6 on IPv4-only service (#10540)
• 81d6f41 build(deps): bump oss/go/microsoft/golang from e1475da to ff5a59c (#10520)
• 529fa89 build(deps): bump the all group in /tests with 7 updates (#10542)
• 325b471 build(deps): bump k8s.io/client-go (#10522)
• d1b20c6 build(deps): bump the all group (#10519)
• 97e88c5 build(deps): bump the all group in /pkg/azclient with 4 updates (#10518)
• Additional commits viewable in compare view

Updates sigs.k8s.io/cluster-inventory-api from 0.1.3 to 0.2.0

Release notes

Sourced from sigs.k8s.io/cluster-inventory-api's releases.

v0.2.0

Cluster Inventory API v0.2.0

Cluster Inventory API v0.2.0 adds multicluster.x-k8s.io/v1alpha2 for ClusterProfile and PlacementDecision.

v1alpha1 is still served and remains the storage version for both, so stored objects stay on v1alpha1. Both CRDs are also now in the multicluster category.

Highlights

ClusterProfile

• status.credentialProviders is removed in v1alpha2. Use status.accessProviders instead. v1alpha1 keeps it, deprecated.
• v1alpha2 validates spec.clusterManager.name and status.accessProviders[].cluster more strictly.
• v1alpha2 adds kubectl get columns: display name, manager, version, healthy, age.
• New LabelInventoryMemberIDKey constant for correlating ClusterProfiles that represent the same member cluster (kubernetes/enhancements#6237).

PlacementDecision

• v1alpha2 validates decisions[].clusterProfileRef more strictly.
• v1alpha2 adds kubectl get columns: scheduler, age.

Go packages

• pkg/access applies tls-server-name, insecure-skip-tls-verify, and disable-compression from status.accessProviders[].cluster to the rest.Config.

Docs and release process

• Added a compatibility and deprecation policy, and a faster patch release process that needs sign-off from two maintainers.

Upgrade Notes

v1alpha1 objects and clients keep working. The full migration steps are in docs/api-versions.md.

ClusterProfile

• v1alpha2 clients and pkg/access no longer read status.credentialProviders. Cluster managers that only fill it need to fill status.accessProviders first.
• spec.clusterManager.name must be a valid label value.
• Every status.accessProviders entry needs a cluster whose server is an absolute URL, and proxy-url, if set, must be a valid URL. Leave the entry out until the endpoint is known.
• BuildConfigFromCP now takes a *v1alpha2.ClusterProfile.
• AccessProvider.Cluster and NamedExtension are now this API's own types instead of clientcmd's. The certificate-authority field (a file path) is not available; use certificate-authority-data.

-apiVersion: multicluster.x-k8s.io/v1alpha1
+apiVersion: multicluster.x-k8s.io/v1alpha2
 kind: ClusterProfile
 status:
-  credentialProviders:
-  - name: kubeconfig
-    cluster:
-      server: https://example.example.com
</tr></table> 

... (truncated)

Changelog

Sourced from sigs.k8s.io/cluster-inventory-api's changelog.

Release Process

Plugin OCI images

Plugin binaries are released as OCI images built with Docker Buildx. The plugin binary is placed under /bin/<plugin_name>-plugin (e.g. /bin/secretreader-plugin); when the image is mounted at /plugin, the executable path is /plugin/bin/<plugin_name>-plugin.

Versioning

Plugin OCI images are tagged with the same version as the repository release tag. For example, pushing v0.2.0 publishes all plugin images with tag v0.2.0.

Prerequisites

Promoting images requires kpromo and a fork of kubernetes/k8s.io.

Before the first release, the following must exist in kubernetes/k8s.io:

• registry.k8s.io/images/k8s-staging-cluster-inventory-api/OWNERS
• registry.k8s.io/images/k8s-staging-cluster-inventory-api/images.yaml
• registry.k8s.io/manifests/k8s-staging-cluster-inventory-api/promoter-manifest.yaml (maps the Artifact Registry staging repository to registry.k8s.io/cluster-inventory-api)

See the registry.k8s.io README for setup details.

How to release

1. Push a signed release tag (e.g. git tag -s v1.0.0 && git push origin v1.0.0).
2. Create a draft GitHub release for the tag (e.g. gh release create v1.0.0 --draft --generate-notes --verify-tag).
3. The test-infra postsubmit job builds all plugin images and pushes them to the staging registry (us-central1-docker.pkg.dev/k8s-staging-images/cluster-inventory-api).
4. Create a promotion PR in kubernetes/k8s.io using kpromo:

   kpromo pr \
     --fork <yourname> \
     --project cluster-inventory-api \
     --tag v1.0.0 \
     --staging-repo us-central1-docker.pkg.dev/k8s-staging-images/cluster-inventory-api

5. After the promotion PR is reviewed and merged, the images become available at registry.k8s.io/cluster-inventory-api/<plugin>:<tag>.
6. Publish the draft GitHub release and close the release issue.

A release checklist is available as an issue template. When a release changes CRD versions, CRD fields, or documented public Go APIs, copy the relevant upgrade notes from https://github.com/kubernetes-sigs/cluster-inventory-api/blob/main/docs/api-versions.md into the release changelog.

Local build

• Run make docker-build PLUGIN_NAME=<name> to build a single plugin image locally (e.g. make docker-build PLUGIN_NAME=secretreader). The image is tagged as <plugin_name>:latest by default.
• Run make release-staging VERSION=<tag> REGISTRY=<registry> to build and push all plugin images to a staging registry.

Project release (optional)

... (truncated)

Commits

• dc460e8 Merge pull request #84 from magic-peach/test/credentialplugin-core-coverage
• 19c70d8 test: cover credentialplugin core helpers
• 2c9add1 Merge pull request #83 from kahirokunn/add-inventory-member-id-label
• c5c7fec api: add inventory member ID label constant
• 4695420 Merge pull request #82 from Svarrogh1337/integration-tests/PlacementDecision
• a70ff57 test(integration): expand PlacementDecision validation coverage
• 5e2deaf Merge pull request #80 from kahirokunn/crd-validation-hardening
• 7b41e68 Use Ginkgo contexts in existing integration tests
• 0841ebd Use Ginkgo contexts in new integration tests
• 089c272 Add printer columns and a multicluster category to the CRDs
• Additional commits viewable in compare view

Updates sigs.k8s.io/controller-runtime from 0.23.3 to 0.25.2

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.25.2

What's Changed

• [release-0.25] 🐛 Fix SubResourceCreateOptions.ApplyToSubResourceCreate by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3600
• [release-0.25] ✨ Add metrics handler options by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3603
• [release-0.25] 📖 Document that ReadYourWrite doesn't work correctly with > 1 Namespace by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3610
• [release-0.25] ✨ Add a metric for the readyourwite consistency wait duration by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3613

Full Changelog: kubernetes-sigs/controller-runtime@v0.25.1...v0.25.2

v0.25.1

What's Changed

• 🐛 priorityqueue: fix data race on []*item in logState by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3593
• 🐛 client: fix subresource create RV parse error under read-your-writes consistency by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3596

Full Changelog: kubernetes-sigs/controller-runtime@v0.25.0...v0.25.1

v0.25.0

Highlights

This version of controller-runtime introduces a new experimental ReadYourWritesConsistency feature, which ensures that all writes are reflected in subsequent reads from the default cache-backed client. Stale client reads are arguably the biggest source of friction and sometimes bugs for controller authors, providing this functionality at the library level eliminates that class of problems entirely.

Try it out by setting Client.EnableReadYourWritesConsistency: new(true) in your manager and leave any feedback you may have on the tracking issue.

⚠️ Breaking Changes

• Dependencies: Bump to k8s.io/* v1.37 (#3579 #3575 #3567 #3561 #3547 #3529 #3524)
• Events: Add new EventRecorder interface (#3509)

✨ New Features

• Client: Add a read-your-own-writes client (#3472)
• Fakeclient: Add WithGlobalResourceVersionCounter (#3581)
• Fakeclient: Add scale subresource support for Apply (#3569)
• Metrics: Allow opt-in for client-go REST client metrics (#3510)
• Metrics: Allow overriding client-go REST client metrics latency histogram buckets (#3573)
• Source: Add TypedInformer source (#3520)
• Webhooks: Allow to disable the webhook server by setting the port to -1 (#3481)

🐛 Bug Fixes

• Cache: Fix goroutine leaks in cache Start() methods (#3565)
• Client: Fix regression in Apply typed error handling (#3515)
• Controller: Unlock when Controller.Start() returns with error (#3545)
• Envtest: Fix envtest process stop on Windows (#3519)

... (truncated)

Commits

• 5d8467b Merge pull request #3613 from k8s-infra-cherrypick-robot/cherry-pick-3609-to-...
• 7b211af sparkles: Add a metric for the readyourwite consistency wait duration
• dc84738 Merge pull request #3610 from k8s-infra-cherrypick-robot/cherry-pick-3608-to-...
• c7eb492 book: Document that ReadYourWrite doesn't work correctly with > 1 Namespace
• d837464 Merge pull request #3603 from k8s-infra-cherrypick-robot/cherry-pick-3594-to-...
• 1b98304 sparkles: Add metrics handler options
• 8963baf Merge pull request #3600 from k8s-infra-cherrypick-robot/cherry-pick-3598-to-...
• ade6e0b Fix SubResourceCreateOptions.ApplyToSubResourceCreate
• 67b72c2 [release-0.25] 🐛 client: fix subresource create RV parse error under read-you...
• f997220 [release-0.25] 🐛 priorityqueue: fix data race on []*item in logState (#3593)
• Additional commits viewable in compare view