chore(deps): Update testing-tools

[github-actions]

This PR contains the following updates:

Package	Type	Update	Change	Pending
kubernetes/kubernetes	testing_tools	patch	v1.36.3 → v1.36.4
ministackorg/ministack	testing_tools	patch	1.4.19 → 1.4.21	1.5.0
openbao/openbao (source)	testing_tools	patch	2.6.1 → 2.6.2
zarf-dev/zarf	testing_tools	minor	v0.83.0 → v0.84.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

kubernetes/kubernetes (kubernetes/kubernetes)

v1.36.4

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

ministackorg/ministack (ministackorg/ministack)

v1.4.21

Compare Source

Added

• IoT Core — native mTLS MQTT listener on port 8883 — the embedded broker now also accepts MQTT over TLS on 8883 (IOT_MTLS_ENABLED=0 turns it off, IOT_MTLS_PORT moves it), on by default when cryptography is present, so AWS IoT Device SDK binaries can connect. The broker certificate comes from the local CA (GET /_ministack/iot/ca.pem); a client certificate is optional (none is served under MINISTACK_ACCOUNT_ID, like an unsigned WebSocket upgrade) and an unknown or non-ACTIVE certificate is refused with a 0x05 CONNACK. Contributed by @​iot-rocket.
• RDS — replicated Aurora PostgreSQL readers survive StopDBCluster / StartDBCluster and warm boot — under MINISTACK_RDS_PG_CLUSTER_REPLICATION, StopDBCluster now stops the reader containers alongside the writer and StartDBCluster revives each reader by re-cloning from the writer; the same revival runs on warm boot, so a persisted reader comes back as a real hot standby instead of being demoted to a writer alias. Contributed by @​kiran01bm.
• CloudFormation — AWS::SES::ConfigurationSet and AWS::SES::ConfigurationSetEventDestination — a template carrying an SES configuration set no longer fails with "Unsupported resource type"; both resource types provision (registered in the classic and v2 SES stores, Ref returns the set name, the event destination round-trips), CloudFormation-provisioning fidelity only. Contributed by @​ryan-bennett.

Fixed

• API Gateway (REST) — routing is on the resource+method pair, not the resource alone — a request a matched resource does not serve (a methodless intermediate node, a CORS-preflight-only node, or an undeclared verb) now falls through to a {proxy+} elsewhere in the tree as it does on AWS; only an exact resource+method match keeps the request, and routing precedes authorization. Supersedes the 1.4.16 change that answered a methodless resource 403. Contributed by @​iot-rocket.
• Step Functions — an unimplemented optimized service integration fails instead of silently succeeding — a Task using an arn:aws:states:::<service>:<action> integration MiniStack does not implement fell through to echoing its input back as SUCCEEDED; it now fails with States.Runtime naming the unimplemented resource. Reported by @​iwasakar.
• CloudFormation — a replacement of a custom-named resource is refused instead of destroying data — an update requiring replacement of a resource with an explicit physical name (for example changing a DynamoDB key attribute's type on a table that sets TableName) now fails and rolls back to UPDATE_ROLLBACK_COMPLETE with CloudFormation cannot update a stack when a custom-named resource requires replacing. Rename <name> and update the stack again., leaving the resource and its data intact. Reported by @​iot-rocket.
• CloudFormation — change sets report a valid status, fail when execution fails, and do not outlive their stack — ExecuteChangeSet wrote the invalid EXECUTE_COMPLETE into Status, breaking the CDK's Status == CREATE_COMPLETE gate. Status now stays CREATE_COMPLETE while ExecutionStatus moves to EXECUTE_COMPLETE or EXECUTE_FAILED on the deployment outcome. A no-change set ends FAILED, a missing set returns ChangeSetNotFound (404), a duplicate name is AlreadyExistsException, deleting a stack removes its change sets, executing one deletes the others, and a direct UpdateStack marks pending sets OBSOLETE. Reported by @​iot-rocket.
• RDS — Aurora engine versions are validated on non-create writes and global inheritance — ModifyDBInstance, ModifyDBCluster, CreateGlobalCluster, ModifyGlobalCluster, and global-inherited CreateDBCluster now reject engine versions the catalog does not advertise; modify paths return InvalidParameterCombination / Cannot find upgrade target from {current} with requested version {requested}., ModifyGlobalCluster propagates an accepted version to every member, and a member moved to a different major than its global is refused. Contributed by @​kiran01bm.
• RDS — global Aurora stop/start preserves topology and MySQL replication — StopDBCluster and StartDBCluster are now limited to sole-member global databases (InvalidDBClusterStateFault, 400), deleting a primary's last instance preserves compute other global members still need, and a successful recreate resets stale MySQL replica state before re-linking replication. Contributed by @​kiran01bm.
• S3 — a conditional delete of an absent key is answered correctly — DeleteObject with If-Match on a key that is not there now returns 204 (deleting an already-gone key is done), and If-Match: * is honored as an existence check — it holds against any present object and returns 412 PreconditionFailed when the key is absent — rather than being compared as a literal ETag. Contributed by @​gaul.
• S3 — multipart uploads carry their parts' checksums through to a composite — CreateMultipartUpload records the checksum algorithm, UploadPart validates and echoes each part's checksum, and completion builds the AWS composite (<digest>-<parts>, the digest of the parts' digests) read back through ChecksumMode as COMPOSITE; a mismatch is BadDigest. Contributed by @​gaul.

v1.4.20

Compare Source

Added

• RDS — FailoverDBCluster — forcing an Aurora failover was InvalidAction; it now promotes a reader to writer (explicit TargetDBInstanceIdentifier or the lowest PromotionTier), reporting the transitional failing-over status and flipped IsClusterWriter flags. Metadata-only until per-instance replication lands. Contributed by @​kiran01bm.
• RDS — opt-in Aurora PostgreSQL reader replication — with MINISTACK_RDS_PG_CLUSTER_REPLICATION=1, extra cluster members run their own PostgreSQL containers, cloned with pg_basebackup and streaming WAL as hot standbys (read-only, ReaderEndpoint resolves to a reader). Off by default; Aurora MySQL and the no-flag path keep aliasing the writer's shared container. Contributed by @​kiran01bm.
• CloudFormation — API Gateway (v1) API keys and usage plans — AWS::ApiGateway::ApiKey, UsagePlan and UsagePlanKey failed with Unsupported resource type; they now provision through the runtime stores with Ref and Fn::GetAtt wired, unblocking CDK RestApi/ApiKey and Terraform aws_api_gateway_api_key. Contributed by @​ryan-bennett.
• AWS IoT Jobs — control plane and device data plane — CreateJob fell through to Unsupported IoT path and iot-jobs-data did not exist; the iot service now serves the nine job operations and a new iot-jobs-data service the device ones, sharing one store and the AWS execution state machine. Contributed by @​iot-rocket.

Fixed

• S3 — server-side encryption is stated, validated, and enforced — SSE-S3, SSE-KMS and SSE-C headers were accepted and forgotten. SSE is now contract state: validated on write, echoed on HEAD/GET, and enforced for SSE-C (keyless/plain read 400 InvalidRequest, wrong-key read 403 AccessDenied), following versions, copies and multipart completes. Contributed by @​gaul.
• DynamoDB — key attribute types are enforced on PutItem, Query, and UpdateTable — a key declared S accepted an N value on write and in a key condition, and an attribute-definitions-only UpdateTable changed a key's type in place; all three now return ValidationException, so no API changes a key's type. Reported by @​iot-rocket.
• CloudWatch — extended-statistic percentiles are computed instead of aliased to Average — GetMetricData and alarm evaluation now interpolate pNN from the period's samples on both paths, and a percentile alarm's StateReason reports the actual statistic (e.g. p95). Contributed by @​MGSousa.
• S3 — presigned SigV4 URLs verify for virtual-hosted addressing and temporary credentials — a virtual-hosted URL was rewritten to path-style before its signature was recomputed, and an STS-signed URL was checked against the static secret; verification now runs against the original signed URI and the secret STS issued. Reported by @​mayankgupta57.
• Step Functions — arn:aws:states:::events:putEvents actually publishes the event — the optimized EventBridge integration fell through to the task passthrough, so the state reported SUCCEEDED while nothing reached any target; it now calls EventBridge PutEvents and returns its response. Reported by @​iwasakar.
• S3 — SSE-C is enforced and echoed on UploadPartCopy and CompleteMultipartUpload — UploadPartCopy accepted a part for an SSE-C upload without the upload's key and read an SSE-C copy source without the source key, and neither echoed the stored encryption; UploadPartCopy now requires both keys (including a ?versionId=-qualified source) and echoes SSECustomerAlgorithm/SSECustomerKeyMD5, and CompleteMultipartUpload echoes ServerSideEncryption. Contributed by @​iot-rocket.
• Aurora DSQL — SELECT ... FOR UPDATE is gated on lock strength, not the predicate — strict mode rejected a locking read unless it was a single table with an equality on every key column (0A000), failing quoted identifiers from every mainstream ORM. Measured against a live cluster, FOR UPDATE now locks whatever the query selects, while FOR NO KEY UPDATE/FOR SHARE/FOR KEY SHARE are refused with 0A000. Contributed by @​vivedo.
• Aurora DSQL — quoted identifiers are normalized the way the server stores them — DROP COLUMN "ID" and mixed-case or schema-qualified table names were mis-resolved; identifiers are now folded as PostgreSQL folds them (bare lower-cased, quoted verbatim) and the relation requoted part by part before lookup. Contributed by @​vivedo.
• CloudFormation — AWS::IoT::Policy updates apply instead of rolling the stack back — the type had no update handler, so an edit hit ResourceAlreadyExistsException and rolled back. A changed PolicyDocument is now a no-interruption update stored as a new default version (pruned to IoT's five-version cap), and a changed PolicyName is a replacement. Contributed by @​maximoosemine.
• EC2 — instance public IP and DNS reach the SDKs — DescribeInstances/RunInstances emitted the address under publicIpAddress/publicDnsName rather than the wire tags ipAddress/dnsName, so every SDK dropped both; they now ride the real tags, and generated addresses complete to four octets. Contributed by @​iot-rocket.
• S3 — versioning edge cases: the null version, delete markers, and versioned copies — suspended-bucket PUT/DELETE store under the literal null version, pre-versioning objects stay addressable as VersionId=null, DeleteObjects mints markers (x-amz-delete-marker: true on the hidden 404), and UploadPartCopy/CopyObject honor the source ?versionId=. Contributed by @​gaul.
• S3 — CompleteMultipartUpload honors If-Match / If-None-Match — conditional writes landed on PutObject but were ignored on the multipart path, so a create-once or compare-and-swap upload could silently overwrite; the complete now evaluates the same preconditions (412 on violation, 404 NoSuchKey for If-Match on a missing object). Contributed by @​gaul.
• S3 — canned ACLs are stored, and object ACLs bind to versions — PutBucketAcl/CreateBucket dropped the x-amz-acl header SDKs send, so buckets read back owner-only; both now validate and store the canned grants (InvalidArgument/MalformedACLError/MissingSecurityHeader as on AWS), and object ACLs are per-version like tags. Contributed by @​gaul.
• S3 — CRC64NVME checksums are computed instead of refused — the default SDK/CLI checksum algorithm returned InvalidRequest, so a stock aws s3 cp failed; it is now computed from a stdlib table (no new dependency), validated on upload (BadDigest on mismatch) and returned on GET/HEAD. CRC32C still needs its native library. Contributed by @​gaul.
• CloudFormation — auto-generated physical names keep their uniqueness suffix when truncated — a deeply-nested stack whose generated name exceeded a resource's name cap truncated every resource to the same string and collapsed them onto one; the hash suffix that guarantees uniqueness is now always preserved. Contributed by @​ryan-bennett.
• IAM — role Description charset is validated — CreateRole, UpdateRole and UpdateRoleDescription now reject a description outside IAM's allowed character set or longer than 1000 characters with 400 ValidationError. Reported by @​iot-rocket.
• CloudFormation — AWS::SSM::Parameter goes through the SSM API — instead of writing the store directly, so a create over an existing name fails (ParameterAlreadyExists), updates increment Version, a Name change replaces, SecureString is rejected, and Fn::GetAtt exposes Arn/Type/Value. Reported by @​iot-rocket.
• CloudFormation — AWS::SSM::Parameter::Value<...> is re-resolved on UpdateStack — the parameter name is kept and re-resolved on every operation, so an update with UsePreviousValue=true picks up a value changed in Parameter Store since the last deploy. Reported by @​iot-rocket.
  ||||||| Stash base
• RDS — Aurora engine versions are validated on non-create writes and global inheritance — ModifyDBCluster, CreateGlobalCluster, and ModifyGlobalCluster stored arbitrary Aurora engine versions that the shared engine catalog did not advertise, and CreateDBCluster could inherit such a version from legacy global-cluster state even though supplying it explicitly was rejected. All four paths now use the create-time shared catalog validator and reject unknown versions with InvalidParameterCombination / Cannot find version {version} for {engine} before mutating state. Contributed by @​kiran01bm.
• EC2 — instance public IP and DNS reach the SDKs, and generated addresses are addresses — DescribeInstances and RunInstances emitted the public address under publicIpAddress / publicDnsName, which are not the tags the EC2 wire schema defines (ipAddress / dnsName, per botocore's ec2-2016-11-15 model), so every SDK dropped both fields silently and PublicIpAddress came back absent on instances that had one. They now ride the real tags. Fixing that exposed a second one: _random_ip appended two octets whatever it was given, so a one-octet prefix produced 52.55.218 — AllocateAddress has been handing back that shape as PublicIp all along, and no address parser accepts it. The generator now completes any prefix to four octets. Contributed by @​iot-rocket.
• S3 — CRC64NVME checksums are computed instead of refused — CRC-64/NVME is the algorithm current AWS SDKs and the CLI checksum uploads with by default, and MiniStack answered it with InvalidRequest ("requires optional native dependencies"), so a stock aws s3 cp or aws s3api put-object failed before it began unless the caller knew to set AWS_REQUEST_CHECKSUM_CALCULATION=when_required. The algorithm is plain arithmetic — the reflected form of polynomial 0xAD93D23594C93659 with all-ones init and xorout — so it is now computed from a byte-at-a-time table in the stdlib, adding no dependency: PutObject and CopyObject validate a client-supplied x-amz-checksum-crc64nvme (BadDigest on mismatch) and GetObject / HeadObject return it under x-amz-checksum-mode: ENABLED, typed FULL_OBJECT. The tests pin the implementation to the algorithm's published check value (b"123456789" → 0xAE8B14860A799888) and to a bit-at-a-time reference rather than to itself. CRC32C still requires the native google-crc32c and is still refused.

openbao/openbao (openbao/openbao)

v2.6.2

Compare Source

2.6.2

zarf-dev/zarf (zarf-dev/zarf)

v0.84.0

Compare Source

⚠ BREAKING CHANGES

• v1beta1: use package definition across public packager functionality (#​5173)

Features

• agent: add variable for mutating webhook annotations (#​5243) (1de2f08)
• allow excluding ArgoCD and Flux resources from Zarf Agent mutation (#​5224) (804b22b)
• dev: evaluate helm chart schemas in dev generate-schema (#​5176) (e1ca156)
• injector image flag (#​5214) (86d732a)
• introduce zarf dev template (#​5206) (826d2a0)
• v1beta1: load v1beta1 packages (#​5048) (f82e001)
• v1beta1: use package definition across public packager functionality (#​5173) (7a33a42)

Bug Fixes

• add values flags to dev deploy and init (#​5234) (fc9226f)
• deprecated schema fields (#​5195) (f21f80a)
• negotiate oci scheme for allowing plain http oci endpoints (#​5197) (b5fbffa)
• packager.Remove() uses ZarfDefaultTimeout as default timeout (#​5253) (11f82f3)
• registry mode not handled properly in update-creds (#​5230) (b2a4132)
• replace mimetype with archives (#​5228) (a4bfd8a)

Refactoring

• move template out of internal (#​5212) (15e05ba)

What's Changed

🚀 Updates

• chore(main): release 0.84.0 by @​zarf-release-please[bot] in #​5196

Full Changelog: zarf-dev/zarf@v0.84.0-rc1...v0.84.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.84.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.84.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.84.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.84.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.