Bump the security group across 1 directory with 3 updates

[dependabot]

Bumps the security group with 3 updates in the / directory: github.com/google/cel-go, github.com/open-telemetry/opentelemetry-operator and helm.sh/helm/v3.

Updates github.com/google/cel-go from 0.28.1 to 0.29.0

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.29.0

What's Changed

New Features

• Add JSON encoder extension — a new ext library for JSON encoding by @​rohan-patnaik in cel-expr/cel-go#1340
• Upstream network.IP/CIDR support from Kubernetes by @​tdesrosi in cel-expr/cel-go#1238
• Managed execution frame with async call foundations by @​TristonianJones in cel-expr/cel-go#1316
• Execution frame integration with updated InterpretableV2 by @​TristonianJones in cel-expr/cel-go#1344
• Add conformance test runner for CEL Policies by @​l46kok in cel-expr/cel-go#1319

Bug Fixes

• Fix unintentional unwrapping of optionals at any level of depth by @​TristonianJones in cel-expr/cel-go#1315
• Fix has() unknown propagation during partial evaluation by @​0xASTRA in cel-expr/cel-go#1324
• Enforce expression size limit before source construction by @​thesmartshadow in cel-expr/cel-go#1302
• Policy variable scoping fixes by @​jnthntatum in cel-expr/cel-go#1321
• Emit valid CEL for doubles in scientific notation in the parser/unparser by @​moraneus in cel-expr/cel-go#1326
• Allow aliases for simple names in containers by @​rohan-patnaik in cel-expr/cel-go#1327
• Reject out-of-range minutes in timezone offset parsing by @​alhudz in cel-expr/cel-go#1336
• Validate offset on empty-string path in indexOf and lastIndexOf by @​alhudz in cel-expr/cel-go#1335
• Guard int32/uint32 map key narrowing in qualifyInternal by @​alhudz in cel-expr/cel-go#1337
• Add max size check to genRange() in ext/lists to prevent OOM by @​marwan9696 in cel-expr/cel-go#1310

Cost Tracking

• Ensure receiver and global matches cost estimates agree by @​TristonianJones in cel-expr/cel-go#1350
• startsWith/endsWith runtime cost agreement with checked cost by @​TristonianJones in cel-expr/cel-go#1351
• Avoid repeated construction of cost tracker by @​pohly in cel-expr/cel-go#1357

Testing & Tooling

• Test Runner usability improvements by @​jnthntatum in cel-expr/cel-go#1320
• Minor updates to test coverage and code quality by @​TristonianJones in cel-expr/cel-go#1318
• Remove duplicate policy tests now covered by policy conformance tests by @​l46kok in cel-expr/cel-go#1332
• Minor Google3 import fixes by @​l46kok in cel-expr/cel-go#1331

Documentation

• Update documentation for nested first-match rules by @​jnthntatum in cel-expr/cel-go#1323
• Add migration warning to README by @​dmitriplotnikov in cel-expr/cel-go#1330

Commits

• fa16799 avoid repeated construction of cost tracker (#1357)
• ea3d5c0 feat(ext): add json encoder (#1340)
• a4d0d64 startsWith / endsWith runtime cost agreement with checked cost (#1351)
• d4efa77 Ensure receiver and global matches cost estimates agree (#1350)
• 13cff33 ext/lists: add max size check to genRange() to prevent OOM (#1310)
• f0ffa7e Execution frame integration with updated IntepretableV2 (#1344)
• f1ec2f6 guard int32/uint32 map key narrowing in qualifyInternal (#1337)
• 258e7c8 Managed execution frame with async call foundations (#1316)
• 14f6746 validate offset on empty-string path in indexOf and lastIndexOf (#1335)
• 783267d reject out-of-range minutes in timezone offset parsing (#1336)
• Additional commits viewable in compare view

Updates github.com/open-telemetry/opentelemetry-operator from 0.143.0 to 0.152.0

Release notes

Sourced from github.com/open-telemetry/opentelemetry-operator's releases.

Release v0.152.0

0.152.0

🛑 Breaking changes 🛑

• api: Move config parsing and CRD metrics from apis to internal package (#4362)
  • Methods on *Config (package apis/v1beta1) converted to standalone functions in internal/otelconfig, now taking *v1beta1.Config as the first parameter:
    • GetEnabledComponents, GetReceiverPorts, GetExporterPorts, GetExtensionPorts, GetReceiverAndExporterPorts, GetAllPorts, GetEnvironmentVariables, GetAllRbacRules, ApplyDefaults, GetLivenessProbe, GetReadinessProbe, GetStartupProbe, Yaml, NullObjects
  • Methods on *Service converted to functions in internal/otelconfig:
    • MetricsEndpoint, GetTelemetry
    • ApplyDefaults → renamed to ServiceApplyDefaults
  • Method on *Telemetry converted to function:
    • ToAnyConfig → renamed to TelemetryToAnyConfig
  • Functions moved from apis/v1beta1 to internal/metrics with renames:
    • BootstrapMetrics → Bootstrap
    • NewMetrics(prv, ctx, cl) → New(ctx, prv, cl) (parameter reorder: ctx now first)
  • Types moved out of apis/v1beta1:
    • MetricsConfig, Telemetry → internal/otelconfig
    • Metrics → internal/metrics

💡 Enhancements 💡

• target allocator: Add support for dropping ServiceMonitor/PodMonitor endpoints that reference arbitrary files (#5104)

• auto-instrumentation: Allow to run the mutating webhook using static configuration, without the need for CRDs. (#4201)

  With this change, you can deploy the manager as a mutating webhook without setting up a v1alpha1.Instrumentation custom resource or the v1alpha1.Instrumentation CRD.

  Instead, you can now set up instrumentation by configuring the manager via its config file with these settings:

    ignore-missing-collector-crds: true 
    enable-instrumentation-crds: false # Ignore that the CRD is not registered.
    enable-multi-instrumentation: false
    instrumentations: # Static configuration for our instrumentation
      spec:
        exporter:
          endpoint: http://collector.default.svc:4318
        propagators:
          - tracecontext
          - baggage
          - b3
        java:
          image: "java-autoinstrumentation:dev"

• target allocator: Improve the error message when the target allocator is enabled but the Prometheus receiver is not named exactly "prometheus". (#5017)

  When only named instances such as "prometheus/otelcol" are present, the error now lists them and explains that a receiver named exactly "prometheus" is required.

... (truncated)

Changelog

Sourced from github.com/open-telemetry/opentelemetry-operator's changelog.

0.152.0

🛑 Breaking changes 🛑

• api: Move config parsing and CRD metrics from apis to internal package (#4362)
  • Methods on *Config (package apis/v1beta1) converted to standalone functions in internal/otelconfig, now taking *v1beta1.Config as the first parameter:
    • GetEnabledComponents, GetReceiverPorts, GetExporterPorts, GetExtensionPorts, GetReceiverAndExporterPorts, GetAllPorts, GetEnvironmentVariables, GetAllRbacRules, ApplyDefaults, GetLivenessProbe, GetReadinessProbe, GetStartupProbe, Yaml, NullObjects
  • Methods on *Service converted to functions in internal/otelconfig:
    • MetricsEndpoint, GetTelemetry
    • ApplyDefaults → renamed to ServiceApplyDefaults
  • Method on *Telemetry converted to function:
    • ToAnyConfig → renamed to TelemetryToAnyConfig
  • Functions moved from apis/v1beta1 to internal/metrics with renames:
    • BootstrapMetrics → Bootstrap
    • NewMetrics(prv, ctx, cl) → New(ctx, prv, cl) (parameter reorder: ctx now first)
  • Types moved out of apis/v1beta1:
    • MetricsConfig, Telemetry → internal/otelconfig
    • Metrics → internal/metrics

💡 Enhancements 💡

• target allocator: Add support for dropping ServiceMonitor/PodMonitor endpoints that reference arbitrary files (#5104)

• auto-instrumentation: Allow to run the mutating webhook using static configuration, without the need for CRDs. (#4201)

  With this change, you can deploy the manager as a mutating webhook without setting up a v1alpha1.Instrumentation custom resource or the v1alpha1.Instrumentation CRD.

  Instead, you can now set up instrumentation by configuring the manager via its config file with these settings:

    ignore-missing-collector-crds: true 
    enable-instrumentation-crds: false # Ignore that the CRD is not registered.
    enable-multi-instrumentation: false
    instrumentations: # Static configuration for our instrumentation
      spec:
        exporter:
          endpoint: http://collector.default.svc:4318
        propagators:
          - tracecontext
          - baggage
          - b3
        java:
          image: "java-autoinstrumentation:dev"

• target allocator: Improve the error message when the target allocator is enabled but the Prometheus receiver is not named exactly "prometheus". (#5017)

  When only named instances such as "prometheus/otelcol" are present, the error now lists them and explains that a receiver named exactly "prometheus" is required.

... (truncated)

Commits

• 1a9cef0 Prepare release 0.152.0 (#5135)
• d726ee2 Update module github.com/open-telemetry/opamp-go to v0.23.0 (#5096)
• 17ec3c5 Update docker.io/library/golang Docker tag to v1.26 (#5134)
• 3919b67 Update docker.io/library/golang Docker tag to v1.25 (#5126)
• 7531991 Add hostmetrics receiver to ClusterObservability agent (#5130)
• ef1264f Update node Docker tag to v26 (#5132)
• 49e773f Update module go.opentelemetry.io/collector/featuregate to v1.59.0 (#5133)
• 4d65b36 Update github/codeql-action action to v4 (#5131)
• 2c0476c Fix ClusterObservability agent collector for non-OpenShift clusters (#5115)
• 82468ca Add resourcedetection processor to ClusterObservability agent logs pipeline (...
• Additional commits viewable in compare view

Updates helm.sh/helm/v3 from 3.20.0 to 3.20.2

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.20.2

v3.20.2

Helm v3.20.2 is a security patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

• GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

Installation and Upgrading

Download Helm v3.20.2. The common platform binaries are here:

• MacOS amd64 (checksum / 7de04301f28b902a74f6286ed941cadc86ee5e6a9086a18f2ccf1f548e99d618)
• MacOS arm64 (checksum / 139c794c22f16b579d08ddd3008c8038b9bb2814f35b5bcca91f50a1f458978d)
• Linux amd64 (checksum / 258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea)
• Linux arm (checksum / a8a614c740399ff1ef32bcea6be6e4523f17e3376f9cf55c192cc48c8f2d1f19)
• Linux arm64 (checksum / 5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691)
• Linux i386 (checksum / 88e4c1834307cdbc9f3b80920e1a383e4ba50bb488fb0be1b1fbd4918bb6ae73)
• Linux ppc64le (checksum / 98bb26a2f3c0b0c1a50db3181dff192554e0c204a07427d98d6b01e259f23cbe)
• Linux s390x (checksum / 584dd77ef8096d6ef939a1822f72840e749fc8311b2b13ae94df5f786862a56b)
• Linux riscv64 (checksum / 957391d0710d72678acd09959b5dc77888cd007a78a4b99944d3b2fc7e1895ca)
• Windows amd64 (checksum / 24e8e5b71bab4ee17e6f989931ecf4fb144f9916cbe9990c0b6b2ec7b925c454)
• Windows arm64 (checksum / 7c940a73a6882f50b69aec3282549da4a49917669db18fc503db930fb74b9789)

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
• 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

• fix: Chart dot-name path bug 8fb76d6ab555577e98e23b7500009537a471feee (George Jenkins)
• fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 3a8927e275c50cecde273872dad2a5576bd46375 (Terry Howe)

Helm v3.20.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:

... (truncated)

Commits

• 8fb76d6 fix: Chart dot-name path bug
• 3a8927e fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow
• a2369ca chore(deps): bump the k8s-io group with 7 updates
• 90e1056 add image index test
• 911f2e9 fix pulling charts from OCI indices
• 76dad33 Remove refactorring changes from coalesce_test.go
• 45c12f7 Fix import
• 26c6f19 Update pkg/chart/common/util/coalesce_test.go
• 09f5129 Fix lint warning
• 417deb2 Preserve nil values in chart already
• Additional commits viewable in compare view

[Gerrit91]

I guess K8s dependencies will also need to be excluded as they will be defined by Gardener.