[thc1006]

The gomod entry looks only at /, where there is no go.mod, and Dependabot does not search subdirectories for one. So none of the 18 Go modules gets updates: all 34 Dependabot PRs here are for GitHub Actions. operators/o2ims-operator/requirements.txt has no entry either, and its Flask 3.1.2 and Requests 2.32.5 have advisories fixed in 3.1.3 and 2.33.0.

This lists the 18 modules and adds pip for O2IMS.

The modules replace krm-functions/lib with ../lib, so a dependency has to move in all of them at once. Bumping k8s.io/apimachinery only in lib breaks controllers/pkg, nephio-controller-manager, dnn-fn and vlan-fn with go: updates to go.mod needed. Bumping it in every go.mod that lists it builds all 18. group-by: dependency-name gives one PR per dependency across the modules, and allow: dependency-type: all is needed because ipam-fn, nfdeploy-fn and vlan-fn list it as // indirect.

13 of the 31 outdated direct dependencies need Go 1.26 or newer, so their PRs will fail on golang:1.25.6 until Go is bumped. The k8s-ipam pin is safe: Dependabot skips a module whose replace matches the required version.

[nephio-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign liamfallon for approval by writing /assign @liamfallon in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment