build(deps): bump the k8s-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the k8s-dependencies group with 1 update in the /api directory: k8s.io/api.

Updates k8s.io/api from 0.35.1 to 0.36.2

Commits

• 2f4cefd Update dependencies to v0.36.2 tag
• 879d396 Merge remote-tracking branch 'origin/master' into release-1.36
• 030d81f Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• aef6eb6 Add granular authorization for DRA ResourceClaim status updates
• 91061ea Merge pull request #136589 from tosi3k/preemption-mode
• e6b81e2 Add Workload-Aware Preemption fields to Workload and PodGroup APIs
• f8fce2e Merge pull request #136989 from nojnhuh/podgroup-resourceclaim
• b928f5e Workload API: PodGroup ResourceClaims (KEP-5729)
• 61bd78e Merge pull request #137190 from everpeace/KEP-5491-alpha
• 6bf46eb Merge pull request #137028 from nmn3m/feature/dra-resource-pool-status
• Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.35.1 to 0.36.2

Commits

• ae3f98e Update dependencies to v0.36.2 tag
• 2ec982d Merge pull request #139508lalitc375/automated-cherry-pick-of-#139480
• 6a88102 Fix wrong marking of errors
• efb7f26 Merge remote-tracking branch 'origin/master' into release-1.36
• d966e56 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• 79b3632 Merge pull request #137864 from yongruilin/dv-dra-mismatch
• a8822f7 Add slice and map union member support with tests
• 7dba2d0 Use IsZero instead of IsNil for union ratcheting check
• d95710f Fix union validation ratcheting when oldObj is nil
• 729062d Merge pull request #137849 from bryantbiggs/deps/update-kube-openapi
• Additional commits viewable in compare view

Updates k8s.io/utils from 0.0.0-20260108192941-914a6e750570 to 0.0.0-20260210185600-b8788abfbbc2

Commits

• See full diff in compare view

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign everettraven for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• api/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The api/go.mod file updates the Go toolchain from 1.25.7 to 1.26.0 and upgrades Kubernetes modules: k8s.io/api and k8s.io/apimachinery from v0.35.1 to v0.36.0; k8s.io/utils and k8s.io/kube-openapi are moved to newer pseudo-versions. Indirect dependencies change: github.com/pmezard/go-difflib is removed, k8s.io/klog/v2 is bumped to v2.140.0, and sigs.k8s.io/structured-merge-diff/v6 is bumped from v6.3.1 to v6.3.2. No exported/public Go APIs or signatures were modified.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Stable And Deterministic Test Names	❌ Error	Ginkgo test files modified in this PR contain unstable test names using dynamic values from GetControlPlaneWorkloads() via fmt.Sprintf.	Replace dynamic test names in test/e2e/v2/tests files using workload.Name with static descriptive strings. Test titles should not depend on runtime function calls.
Microshift Test Compatibility	⚠️ Warning	New Ginkgo e2e tests added in test/e2e/v2/tests/ use etcd backup features unavailable on MicroShift, lacking proper protection mechanisms.	Add [Skipped:MicroShift] labels to backup_restore_test.go Describe blocks or add IsMicroShiftCluster() checks to skip etcd-dependent tests, as they depend on unavailable etcd operator.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Structure And Quality	✅ Passed	The PR updates Go module dependencies in api/go.mod and adds vendor files. No Ginkgo test files were modified in this PR, making the test structure and quality check not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR only updates Go module dependencies (go.mod/go.sum files) and does not add any new Ginkgo e2e tests. The SNO Test Compatibility check only applies when new tests are added.
Topology-Aware Scheduling Compatibility	✅ Passed	PR updates Go module dependencies only. No manifests, operators, or controllers modified. No scheduling constraints introduced.
Ote Binary Stdout Contract	✅ Passed	PR only updates dependency versions in api/go.mod with no code changes to logging, test setup, or main() functions. Library package with no executable entry points.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR contains only dependency/toolchain version updates in api/go.mod. No new Ginkgo e2e tests were added, so the custom check is not applicable.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the Kubernetes dependency bumps in the api module.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/api/k8s-dependencies-5ed4b9f2e4

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@api/go.mod`:
- Line 3: The Dockerfile.github-actions-runner is pinned to an older Go image
and must be updated to match api/go.mod's go 1.26.0 requirement; locate the
Dockerfile.github-actions-runner line that references the base Go image (e.g.
the FROM golang:1.25.3 or any GO_VERSION build-arg) and change it to use
golang:1.26.0 or a later compatible tag, and update any GO_VERSION
build-arg/defaults or related setup steps so the runner image and go.mod are
consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 83498a5c-9a92-49fe-b6a1-75242f8b80cd

📥 Commits

Reviewing files that changed from the base of the PR and between 60802b1 and 785708c.

⛔ Files ignored due to path filters (119)

• api/go.sum is excluded by !**/*.sum
• api/vendor/github.com/gogo/protobuf/AUTHORS is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/CONTRIBUTORS is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/LICENSE is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/Makefile is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/clone.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/custom_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/decode.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/deprecated.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/discard.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/duration.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/duration_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/encode.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/encode_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/equal.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/extensions.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/extensions_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/lib.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/lib_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/message_set.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/pointer_reflect.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/pointer_reflect_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/pointer_unsafe.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/pointer_unsafe_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/properties.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/properties_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/skip_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/table_marshal.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/table_marshal_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/table_merge.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/table_unmarshal.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/table_unmarshal_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/text.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/text_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/text_parser.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/timestamp.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/timestamp_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/wrappers.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/proto/wrappers_gogo.go is excluded by !**/vendor/**
• api/vendor/github.com/gogo/protobuf/sortkeys/sortkeys.go is excluded by !**/vendor/**
• api/vendor/k8s.io/api/authorization/v1/doc.go is excluded by !**/vendor/**
• api/vendor/k8s.io/api/authorization/v1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !**/*.pb.go
• api/vendor/k8s.io/api/authorization/v1/generated.proto is excluded by !**/vendor/**, !**/generated.proto
• api/vendor/k8s.io/api/authorization/v1/types.go is excluded by !**/vendor/**
• api/vendor/k8s.io/api/authorization/v1/types_swagger_doc_generated.go is excluded by !**/vendor/**, !**/types_swagger_doc_generated.go
• api/vendor/k8s.io/api/authorization/v1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/k8s.io/api/core/v1/doc.go is excluded by !**/vendor/**
• api/vendor/k8s.io/api/core/v1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !**/*.pb.go
• api/vendor/k8s.io/api/core/v1/generated.proto is excluded by !**/vendor/**, !**/generated.proto
• api/vendor/k8s.io/api/core/v1/toleration.go is excluded by !**/vendor/**
• api/vendor/k8s.io/api/core/v1/types.go is excluded by !**/vendor/**
• api/vendor/k8s.io/api/core/v1/types_swagger_doc_generated.go is excluded by !**/vendor/**, !**/types_swagger_doc_generated.go
• api/vendor/k8s.io/api/core/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/k8s.io/api/core/v1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/k8s.io/apimachinery/pkg/api/resource/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !**/*.pb.go
• api/vendor/k8s.io/apimachinery/pkg/api/resource/generated.proto is excluded by !**/vendor/**, !**/generated.proto
• api/vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/api/resource/quantity_proto.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/api/resource/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/k8s.io/apimachinery/pkg/api/validate/constraints/constraints.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/api/validate/content/decimal_int.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/api/validate/content/dns.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/api/validate/content/errors.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/api/validate/content/identifier.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/api/validate/content/kube.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/api/validate/content/path.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/doc.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_byte.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string.go is excluded by !**/vendor/**, !**/*_string.go
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !**/*.pb.go
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto is excluded by !**/vendor/**, !**/generated.proto
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/helpers.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/meta.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_fuzz.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/time_fuzz.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types_swagger_doc_generated.go is excluded by !**/vendor/**, !**/types_swagger_doc_generated.go
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.conversion.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/k8s.io/apimachinery/pkg/labels/selector.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/runtime/doc.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/runtime/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !**/*.pb.go
• api/vendor/k8s.io/apimachinery/pkg/runtime/schema/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !**/*.pb.go
• api/vendor/k8s.io/apimachinery/pkg/runtime/scheme.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/runtime/types_proto.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/runtime/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/k8s.io/apimachinery/pkg/util/intstr/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**, !**/*.pb.go
• api/vendor/k8s.io/apimachinery/pkg/util/intstr/generated.proto is excluded by !**/vendor/**, !**/generated.proto
• api/vendor/k8s.io/apimachinery/pkg/util/intstr/instr_fuzz.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/util/intstr/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• api/vendor/k8s.io/apimachinery/pkg/util/net/http.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/util/net/interface.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/util/sets/set.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/util/validation/ip.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/pkg/util/validation/validation.go is excluded by !**/vendor/**
• api/vendor/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/README.md is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_no_slog.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/internal/serialize/keyvalues_slog.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/internal/verbosity/verbosity.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/klog.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/klogr.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/klogr_slog.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/textlogger/options.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/textlogger/textlogger.go is excluded by !**/vendor/**
• api/vendor/k8s.io/klog/v2/textlogger/textlogger_slog.go is excluded by !**/vendor/**
• api/vendor/k8s.io/kube-openapi/LICENSE is excluded by !**/vendor/**
• api/vendor/k8s.io/kube-openapi/pkg/util/trie.go is excluded by !**/vendor/**
• api/vendor/k8s.io/kube-openapi/pkg/util/util.go is excluded by !**/vendor/**
• api/vendor/modules.txt is excluded by !**/vendor/**
• api/vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.go is excluded by !**/vendor/**

📒 Files selected for processing (1)

• api/go.mod

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[bryan-cox]

/uncc @bryan-cox

[hypershift-jira-solve-ci]

All four agents have completed. I now have a complete picture of all three failures. They all share the same root cause: the Dependabot PR only bumped k8s dependencies in the api/ subdirectory but not in the root module, creating a version skew. Let me compile the final report.

Test Failure Analysis Complete

Job Information

• Prow Job: pull-ci-openshift-hypershift-main-verify-deps
• Build ID: 2075385499979091968
• PR: build(deps): bump the k8s-dependencies group across 1 directory with 3 updates #8362 — build(deps): bump the k8s-dependencies group across 1 directory with 3 updates
• Failed Jobs: ci/prow/verify-deps, verify / Verify, lint / Lint
• Root Module: github.com/openshift/hypershift

Test Failure Analysis

Error

# ci/prow/verify-deps:
go: module ./api requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)

# verify / Verify:
k8s.io/client-go/informers imports k8s.io/api/autoscaling/v2beta1: module k8s.io/api@latest found (v0.36.2), but does not contain package k8s.io/api/autoscaling/v2beta1
k8s.io/client-go/informers imports k8s.io/api/autoscaling/v2beta2: module k8s.io/api@latest found (v0.36.2), but does not contain package k8s.io/api/autoscaling/v2beta2
k8s.io/client-go/informers imports k8s.io/api/scheduling/v1alpha1: module k8s.io/api@latest found (v0.36.2), but does not contain package k8s.io/api/scheduling/v1alpha1

# lint / Lint:
level=error msg="Running error: context loading failed: no go files to analyze: running `go mod tidy` may solve the problem"

Summary

All three CI jobs fail because Dependabot PR #8362 only bumped Kubernetes dependencies (k8s.io/api, k8s.io/apimachinery, k8s.io/utils) in the api/ subdirectory module from v0.35.1 to v0.36.2, but did not update the root go.mod or its k8s.io/client-go dependency. This creates an irreconcilable version skew: the root module's k8s.io/client-go@v0.35.1 imports API packages (autoscaling/v2beta1, autoscaling/v2beta2, scheduling/v1alpha1) that were removed in k8s.io/api@v0.36.2. Additionally, the k8s v0.36.2 modules raised the minimum Go version to 1.26.0 while the Prow CI image only provides Go 1.25.8.

Root Cause

The Kubernetes module ecosystem requires all k8s.io/* modules to be bumped in lockstep — they are released together and have tight cross-dependencies. This PR violates that constraint:

1. Partial dependency bump: api/go.mod was bumped to k8s.io/api@v0.36.2 and k8s.io/apimachinery@v0.36.2, but the root go.mod retains k8s.io/client-go@v0.35.1, k8s.io/api@v0.35.1, etc. Since the root module uses replace github.com/openshift/hypershift/api => ./api, it attempts to reconcile v0.36.2 types from the api/ submodule with v0.35.1 client-go, which is impossible.

2. Removed API packages: Kubernetes 1.36 (k8s.io/api@v0.36.2) removed three long-deprecated API groups: autoscaling/v2beta1 (deprecated since k8s 1.23), autoscaling/v2beta2 (deprecated since k8s 1.26), and scheduling/v1alpha1. The root module's k8s.io/client-go@v0.35.1 still imports these packages via its informers package, causing go mod tidy to fail.

3. Go version incompatibility: The k8s v0.36.2 modules set go 1.26.0 in their go.mod. The Prow CI image (openshift_release_rhel-9-release-golang-1.25-openshift-4.23) provides Go 1.25.8 with GOTOOLCHAIN=local, which prevents auto-downloading a newer toolchain. This causes the Prow verify-deps job to fail before it even reaches the dependency resolution errors.

4. Three distinct failure manifestations from one root cause:

   • Prow verify-deps: Go 1.25.8 refuses to process api/go.mod which requires Go 1.26.0
   • GitHub Actions Verify: go mod tidy fails because client-go@v0.35.1 references packages deleted in k8s.io/api@v0.36.2
   • GitHub Actions Lint: golangci-lint on the root module fails to load any packages due to the unresolvable module graph

Recommendations

1. Close this Dependabot PR — A partial bump of only the api/ submodule is insufficient. All k8s.io/* dependencies must be bumped in lockstep across both api/go.mod and the root go.mod.

2. Perform a coordinated full bump — To upgrade to k8s v0.36.2 (Kubernetes 1.36), update all k8s.io/* modules simultaneously in both api/go.mod and the root go.mod:

   • k8s.io/api → v0.36.2
   • k8s.io/apimachinery → v0.36.2
   • k8s.io/client-go → v0.36.2
   • k8s.io/utils → matching version
   • Plus any other k8s.io/* modules (e.g., k8s.io/apiextensions-apiserver, k8s.io/apiserver, k8s.io/component-base, etc.)

3. Update the CI Go toolchain — The Prow CI image must be updated to Go 1.26.x before k8s v0.36.2 dependencies can be used. This likely requires updating the image reference in the Prow job configuration (e.g., switching to rhel-9-release-golang-1.26-openshift-4.23 or equivalent).

4. Consider configuring Dependabot grouping — Update the Dependabot configuration to group all k8s.io/* dependencies across all directories (not just /api) into a single PR to prevent partial bumps.

Evidence

Evidence	Detail
PR scope	Only api/go.mod and api/go.sum modified; root go.mod untouched
Go version in api/go.mod	Changed from go 1.25.7 → go 1.26.0
Prow CI Go version	Go 1.25.8 (GOTOOLCHAIN=local) — cannot process go 1.26.0 modules
k8s.io/api bump	v0.35.1 → v0.36.2 (only in api/go.mod)
Root module k8s.io/client-go	Remains at v0.35.1 (not updated by PR)
Removed packages in k8s 1.36	k8s.io/api/autoscaling/v2beta1, k8s.io/api/autoscaling/v2beta2, k8s.io/api/scheduling/v1alpha1
Prow error	go: module ./api requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)
Verify error	module k8s.io/api@latest found (v0.36.2), but does not contain package k8s.io/api/autoscaling/v2beta1
Lint error	context loading failed: no go files to analyze (module graph unresolvable)
Root module replace directive	replace github.com/openshift/hypershift/api => ./api (ties root to local api/)

---

[openshift-ci]

@dependabot[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-deps	6f2253d	link	true	/test verify-deps

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.