Bump the patch-updates group across 2 directories with 41 updates

[dependabot]

Bumps the patch-updates group with 6 updates in the /vertical-pod-autoscaler directory:

Package	From	To
k8s.io/api	0.36.3	0.36.4
k8s.io/client-go	0.36.3	0.36.4
k8s.io/code-generator	0.36.3	0.36.4
k8s.io/component-base	0.36.3	0.36.4
k8s.io/metrics	0.36.3	0.36.4
github.com/fxamacker/cbor/v2	2.9.2	2.9.3

Bumps the patch-updates group with 25 updates in the /vertical-pod-autoscaler/test directory:

Package	From	To
k8s.io/api	0.36.3	0.36.4
k8s.io/client-go	0.36.3	0.36.4
k8s.io/component-base	0.36.3	0.36.4
k8s.io/metrics	0.36.3	0.36.4
github.com/fxamacker/cbor/v2	2.9.2	2.9.3
k8s.io/apiextensions-apiserver	0.36.3	0.36.4
k8s.io/kubernetes	1.36.3	1.36.4
k8s.io/pod-security-admission	0.36.3	0.36.4
github.com/mattn/go-runewidth	0.0.27	0.0.28
k8s.io/cloud-provider	0.36.3	0.36.4
k8s.io/cluster-bootstrap	0.36.3	0.36.4
k8s.io/cri-api	0.36.3	0.36.4
k8s.io/cri-client	0.36.3	0.36.4
k8s.io/cri-streaming	0.36.3	0.36.4
k8s.io/csi-translation-lib	0.36.3	0.36.4
k8s.io/dynamic-resource-allocation	0.36.3	0.36.4
k8s.io/endpointslice	0.36.3	0.36.4
k8s.io/externaljwt	0.36.3	0.36.4
k8s.io/kube-aggregator	0.36.3	0.36.4
k8s.io/kube-controller-manager	0.36.3	0.36.4
k8s.io/kube-proxy	0.36.3	0.36.4
k8s.io/kube-scheduler	0.36.3	0.36.4
k8s.io/kubectl	0.36.3	0.36.4
k8s.io/mount-utils	0.36.3	0.36.4
k8s.io/sample-apiserver	0.36.3	0.36.4

Updates k8s.io/api from 0.36.3 to 0.36.4

Commits

• 9a6751a Update dependencies to v0.36.4 tag
• 82d8177 Merge pull request #141226 from liggitt/golang-deps-1-36
• a3de3f4 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.3 to 0.36.4

Commits

• 612c0ec Update dependencies to v0.36.4 tag
• 5af8c14 Merge pull request #141226 from liggitt/golang-deps-1-36
• 42e032e Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/client-go from 0.36.3 to 0.36.4

Commits

• 4e24acf Update dependencies to v0.36.4 tag
• a92355f Merge pull request #141226 from liggitt/golang-deps-1-36
• e8e8834 Update golang.org/x deps
• 736cbae Merge pull request #141001 from alancaldelas/automated-cherry-pick-of-#140966...
• f4108cd client-go: restore FakeCustomStore conformance to cache.Store
• See full diff in compare view

Updates k8s.io/code-generator from 0.36.3 to 0.36.4

Commits

• 738eade Update dependencies to v0.36.4 tag
• a01b27c Merge pull request #141226 from liggitt/golang-deps-1-36
• 16eb461 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/component-base from 0.36.3 to 0.36.4

Commits

• 9c647e2 Update dependencies to v0.36.4 tag
• e4943bd Merge pull request #141226 from liggitt/golang-deps-1-36
• 2c67b1f Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/metrics from 0.36.3 to 0.36.4

Commits

• 03c96aa Update dependencies to v0.36.4 tag
• 438c5e3 Merge pull request #141226 from liggitt/golang-deps-1-36
• de5a189 Update golang.org/x deps
• See full diff in compare view

Updates github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.9.3

This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.

Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.

Upgrading to v2.9.3 is recommended.

The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.

What's Changed

• Skip data item when decoding to time.Time fails under certain conditions by @​fxamacker in fxamacker/cbor#803

Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3

Commits

• f0c90b6 Merge pull request #803 from fxamacker/fxamacker/fix-unmarshal-to-time
• c20692a Skip data item when decoding to time.Time fails
• See full diff in compare view

Updates golang.org/x/mod from 0.36.0 to 0.37.0

Commits

• deb1dfc go.mod: update golang.org/x dependencies
• 087f651 modfile: use slices.Backward
• 343ee60 x/mod: allow for aggressively conslidating requires
• See full diff in compare view

Updates golang.org/x/net from 0.55.0 to 0.56.0

Commits

• 9e7fdbf internal/http3: fix wrong argument being given when validating header value
• b686e5f internal/http3: add gzip support to transport
• 8a34885 go.mod: update golang.org/x dependencies
• 72eaf98 dns/dnsmessage: correctly validate SVCB record parameter order
• 82e7868 dns/dnsmessage: avoid panic when parsing SVCB record with truncated data
• b64f1fa internal/http3: add server support for "Trailer:" magic prefix
• 2707ee2 internal/http3: implement HTTP/3 clientConn methods
• 31358cc internal/http3: snapshot response headers at WriteHeader time
• 8ecbaa9 html: don't adjust xml:base
• 8ae811a html: properly handle end script tag in fragment mode
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

• 5071ed6 all: fix some comments to improve readability
• See full diff in compare view

Updates golang.org/x/sys from 0.45.0 to 0.46.0

Commits

• d58dcfa unix: add GPIO constants and structs
• See full diff in compare view

Updates golang.org/x/term from 0.43.0 to 0.44.0

Commits

• 3b43943 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates golang.org/x/text from 0.37.0 to 0.39.0

Commits

• b326f3d go.mod: update golang.org/x dependencies
• 5ae8e57 unicode/norm: avoid infinite loop on invalid input
• 0dc94a2 all: fix some comments
• f4bb632 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates golang.org/x/tools from 0.45.0 to 0.47.0

Commits

• fbf9f2e gopls/internal/cmd: add tests of 'gopls help'
• e891f79 go.mod: update golang.org/x dependencies
• 0602b30 gopls: revert CLI usability revamp to stabilize release
• 60c2434 gopls/internal/cmd: fix regression in initialization
• 29e1583 gopls/internal/mcp: go_diagnostics: use idiomatic iterators
• 0772d6a go/ssa: add test for fix of golang/go#73871 in go/types@go1.25
• 0fdde84 gopls/internal/tool: rename Application to Command and embed in SubCommand
• bd9e76d go/callgraph/vta: document ssa.InstantiateGenerics requirement
• d711ac7 go/ssa: remove incorrect hasTypeParams check
• 439decd gopls/internal/cache/xrefs: avoid materializing Inspector
• Additional commits viewable in compare view

Updates k8s.io/api from 0.36.3 to 0.36.4

Commits

• 9a6751a Update dependencies to v0.36.4 tag
• 82d8177 Merge pull request #141226 from liggitt/golang-deps-1-36
• a3de3f4 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/apimachinery from 0.36.3 to 0.36.4

Commits

• 612c0ec Update dependencies to v0.36.4 tag
• 5af8c14 Merge pull request #141226 from liggitt/golang-deps-1-36
• 42e032e Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/client-go from 0.36.3 to 0.36.4

Commits

• 4e24acf Update dependencies to v0.36.4 tag
• a92355f Merge pull request #141226 from liggitt/golang-deps-1-36
• e8e8834 Update golang.org/x deps
• 736cbae Merge pull request #141001 from alancaldelas/automated-cherry-pick-of-#140966...
• f4108cd client-go: restore FakeCustomStore conformance to cache.Store
• See full diff in compare view

Updates k8s.io/component-base from 0.36.3 to 0.36.4

Commits

• 9c647e2 Update dependencies to v0.36.4 tag
• e4943bd Merge pull request #141226 from liggitt/golang-deps-1-36
• 2c67b1f Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/metrics from 0.36.3 to 0.36.4

Commits

• 03c96aa Update dependencies to v0.36.4 tag
• 438c5e3 Merge pull request #141226 from liggitt/golang-deps-1-36
• de5a189 Update golang.org/x deps
• See full diff in compare view

Updates github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.9.3

This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.

Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.

Upgrading to v2.9.3 is recommended.

The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.

What's Changed

• Skip data item when decoding to time.Time fails under certain conditions by @​fxamacker in fxamacker/cbor#803

Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3

Commits

• f0c90b6 Merge pull request #803 from fxamacker/fxamacker/fix-unmarshal-to-time
• c20692a Skip data item when decoding to time.Time fails
• See full diff in compare view

Updates golang.org/x/mod from 0.36.0 to 0.37.0

Commits

• deb1dfc go.mod: update golang.org/x dependencies
• 087f651 modfile: use slices.Backward
• 343ee60 x/mod: allow for aggressively conslidating requires
• See full diff in compare view

Updates golang.org/x/net from 0.55.0 to 0.56.0

Commits

• 9e7fdbf internal/http3: fix wrong argument being given when validating header value
• b686e5f internal/http3: add gzip support to transport
• 8a34885 go.mod: update golang.org/x dependencies
• 72eaf98 dns/dnsmessage: correctly validate SVCB record parameter order
• 82e7868 dns/dnsmessage: avoid panic when parsing SVCB record with truncated data
• b64f1fa internal/http3: add server support for "Trailer:" magic prefix
• 2707ee2 internal/http3: implement HTTP/3 clientConn methods
• 31358cc internal/http3: snapshot response headers at WriteHeader time
• 8ecbaa9 html: don't adjust xml:base
• 8ae811a html: properly handle end script tag in fragment mode
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

• 5071ed6 all: fix some comments to improve readability
• See full diff in compare view

Updates golang.org/x/term from 0.43.0 to 0.44.0

Commits

• 3b43943 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates golang.org/x/text from 0.37.0 to 0.39.0

Commits

• b326f3d go.mod: update golang.org/x dependencies
• 5ae8e57 unicode/norm: avoid infinite loop on invalid input
• 0dc94a2 all: fix some comments
• f4bb632 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates golang.org/x/tools from 0.45.0 to 0.47.0

Commits

• fbf9f2e gopls/internal/cmd: add tests of 'gopls help'
• e891f79 go.mod: update golang.org/x dependencies
• 0602b30 gopls: revert CLI usability revamp to stabilize release
• 60c2434 gopls/internal/cmd: fix regression in initialization
• 29e1583 gopls/internal/mcp: go_diagnostics: use idiomatic iterators
• 0772d6a go/ssa: add test for fix of golang/go#73871 in go/types@go1.25
• 0fdde84 gopls/internal/tool: rename Application to Command and embed in SubCommand
• bd9e76d go/callgraph/vta: document ssa.InstantiateGenerics requirement
• d711ac7 go/ssa: remove incorrect hasTypeParams check
• 439decd gopls/internal/cache/xrefs: avoid materializing Inspector
• Additional commits viewable in compare view

Updates k8s.io/apiextensions-apiserver from 0.36.3 to 0.36.4

Commits

• 88434be Update dependencies to v0.36.4 tag
• eab2e40 Merge pull request #141226 from liggitt/golang-deps-1-36
• b3cdc3a Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/apiserver from 0.36.3 to 0.36.4

Commits

• ce1e901 Update dependencies to v0.36.4 tag
• 21904f2 Merge pull request #141226 from liggitt/golang-deps-1-36
• 5fc50b1 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/kubernetes from 1.36.3 to 1.36.4

Release notes

Sourced from k8s.io/kubernetes's releases.

v1.36.4

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

Commits

• bb826b1 Release commit for Kubernetes v1.36.4
• e460e27 Merge pull request #141226 from liggitt/golang-deps-1-36
• 058fd20 Merge pull request #140955bart0sh/automated-cherry-pick-of-#140274
• cabfdff Merge pull request #140685iomarsayed/automated-cherry-pick-of-#139162
• caf1205 Merge pull request #140504 from thc1006/dra/counter-poolid-backport-1.36
• ee27fac Merge pull request #141004 from natasha41575/automated-cherry-pick-of-41575...
• 8f417fd Merge pull request #139146mattcary/automated-cherry-pick-of-#138837
• 80ea038 Make sure gated pods are flushed with the same frequency as non-gated
• b8fe554 Update golang.org/x deps
• dbbb4a9 Merge pull request #141001 from alancaldelas/automated-cherry-pick-of-#140966...
• Additional commits viewable in compare view

Updates k8s.io/pod-security-admission from 0.36.3 to 0.36.4

Commits

• 8d3d261 Update dependencies to v0.36.4 tag
• f32dd2f Merge pull request #141226 from liggitt/golang-deps-1-36
• eb2e478 Update golang.org/x deps
• See full diff in compare view

Updates github.com/mattn/go-runewidth from 0.0.27 to 0.0.28

Commits

• 554428c Merge pull request #105 from mattn/lazy-width-lut
• 27d1448 Avoid regexp and map construction at package load
• 69a63c6 Build the strict width LUT lazily to fix startup regression
• See full diff in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits

• 45460e0 go.mod: update golang.org/x dependencies
• d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
• e2ffffe ssh: reject incomplete gssapi-with-mic configurations
• 60e158a ssh/test: isolate CLI tests from user SSH config and agent
• 1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
• 3872a2b ssh/knownhosts: verify declared key type matches decoded key
• 9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
• 8f405a4 ssh: validate ECDSA curve matches expected algorithm
• bb41b3d ssh: improve DH GEX group selection using PreferredBits
• e04e721 ssh/agent: validate ed25519 private key length in Add
• Additional commits viewable in compare view

Updates k8s.io/cloud-provider from 0.36.3 to 0.36.4

Commits

• 4576165 Update dependencies to v0.36.4 tag
• f191cdd Merge pull request #141226 from liggitt/golang-deps-1-36
• 8497ca6 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/cluster-bootstrap from 0.36.3 to 0.36.4

Commits

• 985296f Update dependencies to v0.36.4 tag
• 82c92eb Merge pull request #141226 from liggitt/golang-deps-1-36
• 046a3a2 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/component-helpers from 0.36.3 to 0.36.4

Commits

• 186346d Update dependencies to v0.36.4 tag
• 3c7d5fb Merge pull request #141226 from liggitt/golang-deps-1-36
• a8ecd9a Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/controller-manager from 0.36.3 to 0.36.4

Commits

• 9de65bd Update dependencies to v0.36.4 tag
• 50ace1b Merge pull request #141226 from liggitt/golang-deps-1-36
• 4ab8b0b Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/cri-api from 0.36.3 to 0.36.4

Commits

• e1a9a06 Merge pull request #141226 from liggitt/golang-deps-1-36
• 3a28429 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/cri-client from 0.36.3 to 0.36.4

Commits

• d68c860 Update dependencies to v0.36.4 tag
• fe707d2 Merge pull request #141226 from liggitt/golang-deps-1-36
• 59e94ee Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/cri-streaming from 0.36.3 to 0.36.4

Commits

• 2b3602e Update dependencies to v0.36.4 tag
• 239ef16 Merge pull request #141226 from liggitt/golang-deps-1-36
• 2832f73 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/csi-translation-lib from 0.36.3 to 0.36.4

Commits

• 4d60014 Update dependencies to v0.36.4 tag
• 6504f8f Merge pull request #141226 from liggitt/golang-deps-1-36
• 59febf6 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/dynamic-resource-allocation from 0.36.3 to 0.36.4

Commits

• 715ec06 Update dependencies to v0.36.4 tag
• b6136e7 Merge pull request #141226 from liggitt/golang-deps-1-36
• 66f3fb5 Merge pull request #140504 from thc1006/dra/counter-poolid-backport-1.36
• b4a6049 Update golang.org/x deps
• 8036b6b DRA: key the structured allocator counter caches by PoolID
• See full diff in compare view

Updates k8s.io/endpointslice from 0.36.3 to 0.36.4

Commits

• 4ec71bd Update dependencies to v0.36.4 tag
• b93898b Merge pull request #141226 from liggitt/golang-deps-1-36
• 2d6bc2a Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/externaljwt from 0.36.3 to 0.36.4

Commits

• c225e17 Merge pull request #141226 from liggitt/golang-deps-1-36
• 930f0ab Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/kms from 0.36.3 to 0.36.4

Commits

• 385b536 Update dependencies to v0.36.4 tag
• 18eabfc Merge pull request #141226 from liggitt/golang-deps-1-36
• 9d9f807 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/kube-aggregator from 0.36.3 to 0.36.4

Commits

• b811110 Update dependencies to v0.36.4 tag
• 7dc9856 Merge pull request #141226 from liggitt/golang-deps-1-36
• 84205c2 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/kube-controller-manager from 0.36.3 to 0.36.4

Commits

• 096ee99 Update dependencies to v0.36.4 tag
• 69cfb8b Merge pull request #141226 from liggitt/golang-deps-1-36
• c54cf4c Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/kube-proxy from 0.36.3 to 0.36.4

Commits

• 3b691f9 Update dependencies to v0.36.4 tag
• 4a64fb5 Merge pull request #141226 from liggitt/golang-deps-1-36
• cccc592 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/kube-scheduler from 0.36.3 to 0.36.4

Commits

• 8b1bf93 Update dependencies to v0.36.4 tag
• 9f4cc78 Merge pull request #141226 from liggitt/golang-deps-1-36
• e4fb71d Merge pull request #140685iomarsayed/automated-cherry-pick-of-#139162
• 0fa2894 Update golang.org/x deps
• e3a2e0c Fix case where preemptor may be stuck in unschedulable queue
• See full diff in compare view

Updates k8s.io/kubectl from 0.36.3 to 0.36.4

Commits

• 1a900af Update dependencies to v0.36.4 tag
• 798df05 Merge pull request #141226 from liggitt/golang-deps-1-36
• c6e09c1 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/kubelet from 0.36.3 to 0.36.4

Commits

• 9b6777e Update dependencies to v0.36.4 tag
• 6d53eca Merge pull request #141226 from liggitt/golang-deps-1-36
• 73ef4f5 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/mount-utils from 0.36.3 to 0.36.4

Commits

• 80cc1ea Merge pull request #141226 from liggitt/golang-deps-1-36
• 45d1821 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/sample-apiserver from 0.36.3 to 0.36.4

Commits

• b92721d Update dependencies to v0.36.4 tag
• 91678c0 Merge pull request #141226 from liggitt/golang-deps-1-36
• c557495 Update golang.org/x deps
• See full diff in compare view

Updates k8s.io/streaming from 0.36.3 to 0.36.4

Commits

• 25f24fa Merge pull request #141226 from liggitt/golang-deps-1-36
• d7b83ea Update golang.org/x deps
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign adrianmoisey for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• vertical-pod-autoscaler/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubernetes-prow]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[adrianmoisey]

/lgtm

(there are a few non-patch, but for the main go.mod file, that is indirect dependencies)