[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/kiwigrid/k8s-sidecar	minor	2.11.2 → 2.14.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

kiwigrid/k8s-sidecar (ghcr.io/kiwigrid/k8s-sidecar)

v2.14.1

📦 Dependencies

• build(deps): bump kubernetes from 35.0.0 to 36.0.3
  • PR: #​640

ℹ️ Notes

kubernetes 36 ships an additional asyncio client and makes aiohttp a required dependency, although the sidecar only uses the synchronous client. As a result, the image now also contains aiohttp, multidict, yarl, frozenlist, propcache, aiosignal, aiohappyeyeballs and attrs, which you will see in SBOMs and vulnerability scans. The image grows from about 85 MB to 116 MB unpacked (25 → 29 MB compressed, amd64).

v2.14.0

Compare Source

🚀 Features

• fix: move to stable Python 3.14 base image, fix charset segfault, re-add s390x
  • PR: #​654

🐛 Fixes

• fix: move to stable Python 3.14 base image, fix charset segfault, re-add s390x
  • PR: #​654

v2.13.4

Compare Source

🚀 Features

• build: drop Rust and C++ toolchain from the image build
  • PR: #​653

v2.13.3

Compare Source

📦 Dependencies

• build(deps): remove unused pyasn1 pin
  • PR: #​652

v2.13.2

Compare Source

🐛 Fixes

• ci: serialize releases and only release on an explicit bump token
  • PR: #​647
• ci: pin release changelog range to the tags of the current run
  • PR: #​648
• ci: evaluate only the merge commit message for the release bump
  • PR: #​651

💬 Other

• docs: update tested Kubernetes range in README to v1.25-v1.37
  • PR: #​649

📦 Dependencies

• build(deps): bump kubernetes from 32.0.1 to 35.0.0
  • PR: #​650

v2.13.1

Compare Source

📦 Dependencies

• build(deps): bump requests from 2.33.1 to 2.34.2
  • PR: #​638

v2.13.0

Compare Source

📦 Dependencies

• build(deps-dev): bump setuptools from 83.0.0 to 84.0.0
  • PR: #​639

v2.12.0

Compare Source

🐛 Fixes

• ci: stop release test workflow from pushing images to public registries
  • PR: #​637
• ci: point Dependabot pip updates at pyproject.toml in repo root
  • PR: #​636

📦 Dependencies

• build(deps): bump python-json-logger from 4.1.0 to 4.2.0
  • PR: #​641
• build(deps): bump docker/bake-action from 7.3.0 to 7.4.0
  • PR: #​644
• build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0
  • PR: #​645
• build(deps): bump the codeql-action group with 2 updates
  • PR: #​642
• build(deps): bump mikepenz/release-changelog-builder-action from 6.3.0 to 6.4.0
  • PR: #​643
• ci: bump helm/kind-action to v1.15.1 and test against k8s 1.36/1.37
  • PR: #​630
• build(deps): bump docker/setup-qemu-action from 4.2.0 to 4.4.0
  • PR: #​634
• build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1
  • PR: #​635
• build(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3
  • PR: #​631
• build(deps): bump the codeql-action group with 2 updates
  • PR: #​632

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: ghcr.io/kiwigrid/k8s-sidecar (runtime base image, apps/k8s-sidecar/Dockerfile:4)
• Version: 2.11.2 → 2.14.1
• Type: minor

Release Changes

• 2.12.0: python-json-logger 4.1.0 → 4.2.0; CI fixes only
• 2.13.0: setuptools 83 → 84 (build-time only)
• 2.13.1: requests 2.33.1 → 2.34.2
• 2.13.2: kubernetes client 32.0.1 → 35.0.0; tested k8s range documented as v1.25–v1.37
• 2.13.3: removed unused pyasn1 pin
• 2.13.4: dropped Rust/C++ toolchain from the image build
• 2.14.0: moved to stable Python 3.14 Alpine base (python:3.14.8-alpine3.24), fixed a charset segfault, re-added s390x
• 2.14.1: kubernetes client 35.0.0 → 36.0.3; k8s 36 makes aiohttp a required dependency, so the image gains aiohttp/multidict/yarl/frozenlist/propcache/aiosignal/aiosignal-adjacent wheels — image grows from ~85 MB to ~116 MB unpacked (25 → 29 MB compressed, amd64)

Breaking Changes

None affecting our usage. Verified against the upstream Dockerfile at tag 2.14.1 (raw.githubusercontent.com/kiwigrid/k8s-sidecar/2.14.1/Dockerfile):

• Base remains Alpine (python:3.14.8-alpine3.24), so the apk add layer in apps/k8s-sidecar/Dockerfile:7 still works
• USER 65534:65534 unchanged — our USER nobody:nogroup override resolves to the same UID/GID
• ENTRYPOINT ["python", "-u", "-m", "sidecar"] unchanged — the goss test (process: python: running) target is unchanged
• Config surface (env vars) unchanged

Code Changes Required

None. The PR is the single-line VERSION default bump in apps/k8s-sidecar/docker-bake.hcl:5, which is the only place the version is pinned (verified: no other reference to 2.11.2 in the repo via grep).

Security Impact

No security-fix releases in the range. The new aiohttp dependency tree will appear in SBOMs and vulnerability scans (informational — the sidecar only uses the synchronous k8s client, per upstream release notes). No change to our threat surface.

Verification Performed

• docker build --build-arg VERSION=2.14.1 succeeded; the apk add layer installs cleanly on the new Alpine 3.24 base
• docker image inspect: User=nobody:nogroup, Entrypoint=[python -u -m sidecar] — identical to 2.11.2
• Runtime smoke test: identical startup logs and exit behavior as 2.11.2 (exits with "Should have added {LABEL} as environment variable!" when run without config — pre-existing required env, not a regression)
• docker buildx imagetools inspect ghcr.io/kiwigrid/k8s-sidecar:2.14.1: linux/amd64 and linux/arm64 manifests both present (covers the image-all bake target)

Recommendation

Safe to merge — minor bump of the runtime base, single-line change, local build verified on the new base, runtime behavior identical to the current pin, both bake platforms available upstream, no breaking changes.