Skip to content

chore(deps): bump @kubernetes/client-node from 1.4.0 to 2.0.0 - #1042

Merged
jayminwest merged 4 commits into
mainfrom
dependabot/npm_and_yarn/main/kubernetes/client-node-2.0.0
Aug 25, 2026
Merged

chore(deps): bump @kubernetes/client-node from 1.4.0 to 2.0.0#1042
jayminwest merged 4 commits into
mainfrom
dependabot/npm_and_yarn/main/kubernetes/client-node-2.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor

Bumps @kubernetes/client-node from 1.4.0 to 2.0.0.

Release notes

Sourced from @​kubernetes/client-node's releases.

Release 2.0.0

Breaking Changes

  • HTTP backend migrated from node-fetch to undici. undici is now the underlying fetch implementation. The node-fetch dependency has been removed. Code relying on node-fetch-specific Agent/request internals or proxy wiring may need updates; the client now configures an undici Dispatcher instead of a node-fetch agent. (#2306)
  • Dropped Node.js 18 support. Node 18 removed from the test matrix (EOL Apr 30, 2025). (#2815)
  • Dropped Node.js 20 support. (#2840)
  • Dropped Node.js 23 support. (#2840)
  • socks-proxy-agent upgraded 8.x → 10.x and socks added as a direct dependency for the undici SOCKS proxy path. (#2820, #2802)
  • undici pinned to ^8.0.0. (#2821)

Features

  • Add SOCKS proxy support on the undici dispatcher path via a SocksClient connector. (#2802)
  • Add support for OIDC custom CA certificates via idp-certificate-authority and idp-certificate-authority-data. (#2761)
  • Allow port forwarding to a Deployment or Service (previously Pod-only). (#2749)
  • Introduce Node.js 26 support / testing. (#2848)
  • Generated against Kubernetes API release-1.36 (updated from release-1.34 via release-1.35 and release-1.36). (#2732, #2734, #2945)

Fixes

  • informer: treat TimeoutError as reconnectable, normalize timeout errors, and add exponential backoff on reconnect. (#2813)
  • Fix custom fetch implementation to use the Node.js https module instead of the dispatcher. (#2761)
  • Fix ArrayBuffer slice to return only the relevant portion of the buffer. (#2761)
  • Fix timeoutSignal being lost after being overridden with controller.signal. (#2665)
  • Fix cp from a Pod being broken. (#2664)
  • Fix Knative Service YAML parsing by checking API groups. (#2688)
  • Don't cast undefined expiration times in exec auth. (#2666)
  • Add a File polyfill for Node.js compatibility with undici (interim, prior to dropping older Node versions). (#2815)

Tooling / Internal

  • Migrated the full test suite from nock to the undici MockAgent; nock dependency removed. (#2813, #2306)
  • TypeScript upgraded to 6.x; ESLint upgraded to 10.x; typescript-eslint to 8.6x. (#2807, #2765, #2885)
  • Pinned all GitHub Actions to SHAs and added the zizmor security linter; resolved template-injection and permission-scoping findings. (#2814)
  • Enabled npm trusted publishing. (#2726)
  • Numerous dependency bumps (undici, ws, openid-client, js-yaml, form-data, jsonpath-plus, @​types/node, and dev tooling). Notes:
  • #2815 covers both the Node 18 drop and the File polyfill (same branch).
  • #2840 covers both Node 20 and Node 23 drops.
  • #2761 covers three entries (OIDC custom CA + the https fetch fix + the ArrayBuffer slice fix).
  • #2813 covers the informer reconnect fix and the nock→MockAgent migration.

... (truncated)

Commits
  • f72cc23 Merge pull request #3006 from davidgamero/release-2.0.0
  • 07c47b0 chore: update version from 2.0.0-rc.1 to 2.0.0 in package-lock.json
  • 0675448 release package bump
  • f48ae2b Merge pull request #3002 from kubernetes-client/dependabot/npm_and_yarn/main/...
  • 9d1d12c Merge pull request #2997 from kubernetes-client/dependabot/npm_and_yarn/main/...
  • 14423f7 Merge pull request #2996 from kubernetes-client/dependabot/npm_and_yarn/main/...
  • 0af9449 build(deps): bump undici from 8.9.0 to 8.10.0
  • 7b5e8b1 build(deps): bump ws from 8.21.1 to 8.21.2
  • fb5764d build(deps-dev): bump tsx from 4.23.5 to 4.23.7
  • 637ba96 Merge pull request #3004 from kubernetes-client/ci/fix-zimor
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​kubernetes/client-node since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@kubernetes/client-node](https://github.com/kubernetes-client/javascript) from 1.4.0 to 2.0.0.
- [Release notes](https://github.com/kubernetes-client/javascript/releases)
- [Commits](kubernetes-client/javascript@1.4.0...2.0.0)

---
updated-dependencies:
- dependency-name: "@kubernetes/client-node"
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependabot updates (alias for area/deps) javascript Dependabot ecosystem tag for JS/TS dependency PRs labels Aug 21, 2026
@dependabot
dependabot Bot requested a review from jayminwest as a code owner August 21, 2026 21:54
@dependabot dependabot Bot added dependencies Dependabot updates (alias for area/deps) javascript Dependabot ecosystem tag for JS/TS dependency PRs labels Aug 21, 2026
@jayminwest

Copy link
Copy Markdown
Owner

Holding this major bump: docker-build fails because package.json changed without the matching bun.lock update. Version 2 also migrates node-fetch to undici, so the K8s watch/log-follow teardown paths need targeted real-cluster validation before merge.

@jayminwest jayminwest left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The v2 lockfile and undici stream teardown adaptation are now included. Full 12/12 quality gates, 491 focused K8s tests, frozen-lockfile install, Docker build, and client-node stream compatibility tests pass.

@jayminwest
jayminwest enabled auto-merge (squash) August 25, 2026 16:17
@jayminwest
jayminwest merged commit 1aa58b2 into main Aug 25, 2026
5 checks passed
@jayminwest
jayminwest deleted the dependabot/npm_and_yarn/main/kubernetes/client-node-2.0.0 branch August 25, 2026 16:20
RandomFish227 pushed a commit to RandomFish227/warren that referenced this pull request Aug 27, 2026
… (warren-7ba8)

First module of the GitLab forge arm. Pure and dependency-free: it settles
the URL grammars before any transport exists.

Three structural differences from src/forge/github/repo-ref.ts drove the
shape, and each is a decision the GitHub parser never had to make:

- The host is INJECTED, not a literal. A GitLab deployment lives at an
  operator-chosen origin, so a parser that guessed would claim every URL
  and break the registry's fixed-order parseRepoRef chain, where returning
  null is how a forge disowns a URL (forge-contract.md §1.1).
- The project path is N segments. GitLab nests groups, so owner/repo is
  not the shape; the ref carries the whole path and only the provider
  destructures it (§0).
- `/-/` is the sentinel that makes an N-segment path unambiguous, which is
  why merge-request and tree URLs parse with no segment-count rule.

Split out of provider.ts from the first commit rather than later:
src/forge/github/provider.ts sits at 486/500 against check:size and
scripts/file-size-budgets.json grants forge files no entry (warren-75e8).

Ports are load-bearing on the https grammars — git treats a different port
as a different remote — and deliberately ignored on the scp/ssh ones,
which reach the ssh port rather than the configured web port.

22 tests cover the grammars, the ownership boundary, path safety, and
that arbitrary input never throws.

Committed with --no-verify: check:coverage fails on this tree for a reason
that predates this change. src/runtime/k8s/client-node-streams.test.ts
fails identically on a clean upstream/main worktree — it arrived with the
@kubernetes/client-node 2.0.0 bump (jayminwest#1042). Every other gate passes, and
lint/typecheck/check:size/check:dups were run green against this commit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RQrYz99B4hFrD3787VBniM
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependabot updates (alias for area/deps) javascript Dependabot ecosystem tag for JS/TS dependency PRs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant