Skip to content

Switch sermodigital jose to golang jwt - #3853

Closed
benjaminguttmann-avtq wants to merge 545 commits into
cloudfoundry:v8from
benjaminguttmann-avtq:switch-sermodigital-jose-to-golang-jwt
Closed

Switch sermodigital jose to golang jwt#3853
benjaminguttmann-avtq wants to merge 545 commits into
cloudfoundry:v8from
benjaminguttmann-avtq:switch-sermodigital-jose-to-golang-jwt

Conversation

@benjaminguttmann-avtq

@benjaminguttmann-avtq benjaminguttmann-avtq commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

…ompat

Note: Please create separate PR for every branch (main and v8) as needed.

Description of the Change

This PR switches from using github.com/SermoDigital to use github.com/golang-jwt as there are issues with SermoDigital and golang 1.27.0 (https://github.com/cloudfoundry/cf_exporter/actions/runs/32944433448/job/98102027604).

goroutine 1 [running]:
crypto.RegisterHash(...)
	/opt/hostedtoolcache/go/1.27.0/x64/src/crypto/crypto.go:158
github.com/SermoDigital/jose/crypto.init.0()
	/home/runner/work/cf_exporter/cf_exporter/vendor/github.com/SermoDigital/jose/crypto/none.go:11 +0x25
FAIL	github.com/cloudfoundry/cf_exporter/v2/fetcher	0.008s
=== RUN   TestFilters
Running Suite: Filters Suite

Note: PR has been created with the usage of AI

Why Is This PR Valuable?

Makes it possible to bump golang to v1.27.0.

Applicable Issues

List any applicable GitHub Issues here

How Urgent Is The Change?

Is the change urgent? If so, explain why it is time-sensitive.

Other Relevant Parties

Who else is affected by the change?

dependabot Bot and others added 30 commits August 22, 2024 18:41
@dependabot
Bump github.com/onsi/ginkgo/v2 from 2.20.0 to 2.20.1 (cloudfoundry#3129)
a8a797e 
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.20.0 to 2.20.1.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.20.0...v2.20.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/clock from 1.3.0 to 1.4.0 (cloudfoundry#3135)
0b3a82a 
Bumps [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) from 1.3.0 to 1.4.0.
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.3.0...v1.4.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/clock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/lager/v3 from 3.1.0 to 3.2.0 (cloudfoundry…
dc62c14 
…#3136)

Bumps [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) from 3.1.0 to 3.2.0.
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.1.0...v3.2.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@joaopapereira
Fix linter task (cloudfoundry#3132)
d29735c 
Signed-off-by: João Pereira <joaod@vmware.com>
@dependabot
Bump code.cloudfoundry.org/clock from 1.4.0 to 1.5.0 (cloudfoundry#3143)
4546ec4 
Bumps [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.4.0...v1.5.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/clock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/lager/v3 from 3.2.0 to 3.3.0 (cloudfoundry…
b580d96 
…#3144)

Bumps [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/clock from 1.5.0 to 1.7.0 (cloudfoundry#3160)
7497781 
Bumps [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) from 1.5.0 to 1.7.0.
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.5.0...v1.7.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/clock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@gururajsh
Bump stack from cflinuxfs3 to cflinuxfs4 (cloudfoundry#3155)
33cd63b 
Use CAPI release version var
Remove min CAPI jobs
Move ops-files from cli-ci to this repo
@dependabot
Bump code.cloudfoundry.org/clock from 1.7.0 to 1.8.0 (cloudfoundry#3162)
7eff23a 
Bumps [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) from 1.7.0 to 1.8.0.
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.7.0...v1.8.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/clock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/bytefmt from 0.1.0 to 0.5.0 (cloudfoundry#…
95dddb5 
…3163)

Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt) from 0.1.0 to 0.5.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.1.0...v0.5.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/tlsconfig from 0.1.0 to 0.2.0 (cloudfoundr…
4616970 
…y#3165)

Bumps [code.cloudfoundry.org/tlsconfig](https://github.com/cloudfoundry/tlsconfig) from 0.1.0 to 0.2.0.
- [Release notes](https://github.com/cloudfoundry/tlsconfig/releases)
- [Commits](cloudfoundry/tlsconfig@v0.1.0...v0.2.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/bytefmt from 0.5.0 to 0.6.0 (cloudfoundry#…
854ced2 
…3172)
@dependabot @a-b
Bump code.cloudfoundry.org/clock from 1.8.0 to 1.9.0 (cloudfoundry#3171)
128cae9 
Bumps [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) from 1.8.0 to 1.9.0.
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.8.0...v1.9.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/clock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: AL Berez <a-b@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/bytefmt from 0.6.0 to 0.8.0 (cloudfoundry#…
1298cb3 
…3177)

Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt) from 0.6.0 to 0.8.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.6.0...v0.8.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/tlsconfig from 0.2.0 to 0.4.0 (cloudfoundr…
6adec20 
…y#3183)

Bumps [code.cloudfoundry.org/tlsconfig](https://github.com/cloudfoundry/tlsconfig) from 0.2.0 to 0.4.0.
- [Release notes](https://github.com/cloudfoundry/tlsconfig/releases)
- [Commits](cloudfoundry/tlsconfig@v0.2.0...v0.4.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/clock from 1.9.0 to 1.12.0 (cloudfoundry#3187
05dc1ad 
)

Bumps [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) from 1.9.0 to 1.12.0.
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.9.0...v1.12.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/clock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/tlsconfig from 0.4.0 to 0.5.0 (cloudfoundr…
334dee9 
…y#3193)

Bumps [code.cloudfoundry.org/tlsconfig](https://github.com/cloudfoundry/tlsconfig) from 0.4.0 to 0.5.0.
- [Release notes](https://github.com/cloudfoundry/tlsconfig/releases)
- [Commits](cloudfoundry/tlsconfig@v0.4.0...v0.5.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/bytefmt from 0.8.0 to 0.10.0 (cloudfoundry…
c274ac6 
…#3192)

Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt) from 0.8.0 to 0.10.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.8.0...v0.10.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/clock from 1.12.0 to 1.13.0 (cloudfoundry#…
d231252 
…3197)

Bumps [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) from 1.12.0 to 1.13.0.
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.12.0...v1.13.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/clock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@a-b
Remove redis ops-file (cloudfoundry#3212)
65b505b 
Newer cf-deployment has valkey so this ops file is now redundant.
@dependabot
Bump github.com/maxbrunsfeld/counterfeiter/v6 from 6.8.1 to 6.9.0 (cl…
8e2bb6f 
…oudfoundry#3202)

Bumps [github.com/maxbrunsfeld/counterfeiter/v6](https://github.com/maxbrunsfeld/counterfeiter) from 6.8.1 to 6.9.0.
- [Release notes](https://github.com/maxbrunsfeld/counterfeiter/releases)
- [Commits](maxbrunsfeld/counterfeiter@v6.8.1...v6.9.0)

---
updated-dependencies:
- dependency-name: github.com/maxbrunsfeld/counterfeiter/v6
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump code.cloudfoundry.org/lager/v3 from 3.3.0 to 3.6.0 (cloudfoundry…
2f74612 
…#3205)

Bumps [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) from 3.3.0 to 3.6.0.
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.3.0...v3.6.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@gururajsh
Bump go to 1.23.1 (cloudfoundry#3216)
e15565b 
Bump go to latest version which fixes CVEs.
@dependabot
Bump k8s.io/apimachinery from 0.31.0 to 0.31.1 (cloudfoundry#3222)
25c91fd 
Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.31.0 to 0.31.1.
- [Commits](kubernetes/apimachinery@v0.31.0...v0.31.1)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@a-b
Keep environments running when in debug mode (cloudfoundry#3213)
d3b1e8c
@dependabot
Bump github.com/cyphar/filepath-securejoin from 0.3.1 to 0.3.2 (cloud…
301073b 
…foundry#3221)

Bumps [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) from 0.3.1 to 0.3.2.
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.3.1...v0.3.2)

---
updated-dependencies:
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@pbusko @modulo11
@nicolasbender @c0d1ngm0nk3y @a-b @joaopapereira
[RFC0028] Support for Cloud Native Buildpacks lifecycle (cloudfoundry…
0cc96f4 
…#2871)

Co-authored-by: Johannes Dillmann <j.dillmann@sap.com>
Co-authored-by: Nicolas Bender <nicolas.bender@sap.com>
Co-authored-by: Pavel Busko <pavel.busko@sap.com>
Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>
Co-authored-by: Al Berez <al.berez@broadcom.com>
Co-authored-by: João Pereira <joaopapereira@gmail.com>
@dependabot
Bump k8s.io/client-go from 0.31.0 to 0.31.1 (cloudfoundry#3224)
0083238 
Bumps [k8s.io/client-go](https://github.com/kubernetes/client-go) from 0.31.0 to 0.31.1.
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.31.0...v0.31.1)

---
updated-dependencies:
- dependency-name: k8s.io/client-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@a-b
Manage stale issues and PRs
52a7d21
@a-b
Fix action permissions
781466b
dependabot Bot and others added 28 commits June 12, 2026 17:05
@dependabot
[main](go): Bump the dependencies group with 4 updates (cloudfoundry#…
82745c8 
…3789)

Bumps the dependencies group with 4 updates: [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt), [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock), [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) and [code.cloudfoundry.org/tlsconfig](https://github.com/cloudfoundry/tlsconfig).


Updates `code.cloudfoundry.org/bytefmt` from 0.74.0 to 0.75.0
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.74.0...v0.75.0)

Updates `code.cloudfoundry.org/clock` from 1.72.0 to 1.73.0
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.72.0...v1.73.0)

Updates `code.cloudfoundry.org/lager/v3` from 3.71.0 to 3.72.0
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.71.0...v3.72.0)

Updates `code.cloudfoundry.org/tlsconfig` from 0.56.0 to 0.58.0
- [Release notes](https://github.com/cloudfoundry/tlsconfig/releases)
- [Commits](cloudfoundry/tlsconfig@v0.56.0...v0.58.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-version: 0.75.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/clock
  dependency-version: 1.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-version: 3.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@prkalle
Fix(ci): support Ubuntu Noble stemcell in create-bosh-lite (cloudfoun…
ac534e4 
…dry#3790)

The cf-deployment default stemcell moved from ubuntu-jammy to ubuntu-noble
(cloudfoundry/cf-deployment#1224), which broke the create-bosh-lite workflow.
Three Noble-specific problems plus supporting fixes:

- Warden agents wouldn't connect: Noble warden containers boot under systemd,
  which requires bbl >= 9.0.41 (warden_cpi start_containers_with_systemd:true).
  Provided via the BBL_CLI_VERSION repository variable (>= 9.0.41; set to 9.0.45).

- External DNS broken inside containers: the Noble bosh-dns config lives under
  the "bosh-dns-systemd" addon with disable_recursors:true, so diego-cells
  couldn't resolve buildpacks.cloudfoundry.org and app staging failed
  ("server misbehaving"). bosh-dns-noble-bosh-lite.yml enables recursion with
  the 169.254.169.254 recursor, applied to the dns runtime-config.

- App Envoy sidecars crashed on start ("inotify_fd_ >= 0", exit 134): with
  systemd in every warden container the director host's
  fs.inotify.max_user_instances (128) was exhausted. director-inotify.yml adds
  an os-conf sysctl job (1024 / 524288) to the director via
  create-director-override.sh. inotify limits bind at the host root user
  namespace, so this is set on the director VM, not the diego-cell.

- Increase the bosh-lite director VM to n2-standard-16 (64 GB): the whole
  deployment runs as warden containers on one VM and 32 GB overcommitted memory.

- Fix the failure-cleanup step: `bbl down` was passed
  --gcp-service-account-key=key.json (no such file is created), so it parsed the
  literal string as JSON and failed, leaving orphaned infrastructure on any
  failed run. Authenticate via BBL_GCP_SERVICE_ACCOUNT_KEY, like `bbl up`.

Requires the BBL_CLI_VERSION repository variable to be >= 9.0.41.

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>
@dependabot
[main](go): Bump the dependencies group with 12 updates (cloudfoundry…
10803a1 
…#3793)

Bumps the dependencies group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt) | `0.75.0` | `0.76.0` |
| [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) | `1.73.0` | `1.74.0` |
| [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) | `3.72.0` | `3.73.0` |
| [code.cloudfoundry.org/tlsconfig](https://github.com/cloudfoundry/tlsconfig) | `0.58.0` | `0.59.0` |
| [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.29.0` | `2.31.0` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.41.0` | `1.42.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.52.0` | `0.53.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.55.0` | `0.56.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.43.0` | `0.44.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.37.0` | `0.38.0` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.1` | `0.36.2` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.1` | `0.36.2` |


Updates `code.cloudfoundry.org/bytefmt` from 0.75.0 to 0.76.0
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.75.0...v0.76.0)

Updates `code.cloudfoundry.org/clock` from 1.73.0 to 1.74.0
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.73.0...v1.74.0)

Updates `code.cloudfoundry.org/lager/v3` from 3.72.0 to 3.73.0
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.72.0...v3.73.0)

Updates `code.cloudfoundry.org/tlsconfig` from 0.58.0 to 0.59.0
- [Release notes](https://github.com/cloudfoundry/tlsconfig/releases)
- [Commits](cloudfoundry/tlsconfig@v0.58.0...v0.59.0)

Updates `github.com/onsi/ginkgo/v2` from 2.29.0 to 2.31.0
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.29.0...v2.31.0)

Updates `github.com/onsi/gomega` from 1.41.0 to 1.42.0
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.41.0...v1.42.0)

Updates `golang.org/x/crypto` from 0.52.0 to 0.53.0
- [Commits](golang/crypto@v0.52.0...v0.53.0)

Updates `golang.org/x/net` from 0.55.0 to 0.56.0
- [Commits](golang/net@v0.55.0...v0.56.0)

Updates `golang.org/x/term` from 0.43.0 to 0.44.0
- [Commits](golang/term@v0.43.0...v0.44.0)

Updates `golang.org/x/text` from 0.37.0 to 0.38.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.37.0...v0.38.0)

Updates `k8s.io/apimachinery` from 0.36.1 to 0.36.2
- [Commits](kubernetes/apimachinery@v0.36.1...v0.36.2)

Updates `k8s.io/client-go` from 0.36.1 to 0.36.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.1...v0.36.2)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-version: 0.76.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/clock
  dependency-version: 1.74.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-version: 3.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@prkalle
Update dependencies to fix CVEs (cloudfoundry#3796)
4bcd492 
Updates vulnerable golang.org/x packages in integration/assets/hydrabroker/go.mod
to match the secure versions from the main go.mod:

- golang.org/x/crypto: v0.45.0 → v0.52.0
- golang.org/x/net: v0.47.0 → v0.55.0
- golang.org/x/sys: v0.38.0 → v0.45.0
- golang.org/x/text: v0.31.0 → v0.37.0

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>
@prkalle
[main] Fix CI client-creds integration tests (cloudfoundry#3797)
7c0c8db 
* Fix(ci): add flake-attempts to client-creds integration test target

* Fix: prevent 'cf apps' failure on empty API version
@marckhouzam
Update Go version to 1.26.4 (cloudfoundry#3776)
49be78b 
Signed-off-by: Marc Khouzam <marc.khouzam@broadcom.com>
@prkalle
Fix(ci): restrict integration tests to trusted contributors or safe-t…
d9741b8 
…o-test label (cloudfoundry#3806)

Gate the get-sha job in tests-integration.yml so CI runs automatically
only for contributors with explicit repository write access (OWNER or
COLLABORATOR). All others require a maintainer to add the "safe-to-test"
label, which must be done via a labeled event — not checked by label
presence — eliminating any race condition on new commits.

Add remove-safe-to-test-label.yml to automatically strip the
safe-to-test label when a contributor pushes new commits, so a
maintainer must explicitly re-label before CI runs again on the
updated code.

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>
@prkalle
Fix(ci): correct label gate condition to use event.action instead of …
31ccf08 
…event_name (cloudfoundry#3809)

github.event_name is always 'pull_request_target' for all PR trigger
types. The action type (labeled, synchronize, etc.) is exposed via
github.event.action, so the safe-to-test label check was never
evaluating to true

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>
@prkalle
Fix(ci): prevent delete-env failure due to busy persistent disk on te…
5fbf21b 
…ardown (cloudfoundry#3800)

Add bosh delete-deployment before bbl down in delete-bosh-lite.yml so
that CF warden containers release their bind mounts on the director's
persistent disk prior to bosh delete-env attempting to unmount it.
Without this, umount fails with "target is busy" (exit status 32).

Also align tool versions with repo variables (BBL_CLI_VERSION,
BOSH_CLI_VERSION) instead of hardcoded values, and remove the redundant
--gcp-service-account-key flag since BBL reads BBL_GCP_SERVICE_ACCOUNT_KEY
from the environment automatically.

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>
@marckhouzam
Remove useless new lines in usage text (cloudfoundry#3772)
138e149 
Signed-off-by: Marc Khouzam <marc.khouzam@broadcom.com>
@dependabot
[main](gha): Bump the dependencies group across 1 directory with 2 up…
68dd199 
…dates (cloudfoundry#3815)

Bumps the dependencies group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [actions/cache](https://github.com/actions/cache).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

Updates `actions/cache` from 5 to 6
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[main](go): Bump the dependencies group across 1 directory with 7 upd…
d4d3c9a 
…ates (cloudfoundry#3813)

Bumps the dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt) | `0.76.0` | `0.78.0` |
| [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) | `1.74.0` | `1.76.0` |
| [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) | `3.73.0` | `3.75.0` |
| [code.cloudfoundry.org/tlsconfig](https://github.com/cloudfoundry/tlsconfig) | `0.59.0` | `0.60.0` |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.6.1` | `0.7.0` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.42.0` | `1.42.1` |



Updates `code.cloudfoundry.org/bytefmt` from 0.76.0 to 0.78.0
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.76.0...v0.78.0)

Updates `code.cloudfoundry.org/clock` from 1.74.0 to 1.76.0
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.74.0...v1.76.0)

Updates `code.cloudfoundry.org/lager/v3` from 3.73.0 to 3.75.0
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.73.0...v3.75.0)

Updates `code.cloudfoundry.org/tlsconfig` from 0.59.0 to 0.60.0
- [Release notes](https://github.com/cloudfoundry/tlsconfig/releases)
- [Commits](cloudfoundry/tlsconfig@v0.59.0...v0.60.0)

Updates `github.com/cyphar/filepath-securejoin` from 0.6.1 to 0.7.0
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.6.1...v0.7.0)

Updates `github.com/onsi/ginkgo/v2` from 2.31.0 to 2.32.0
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.31.0...v2.32.0)

Updates `github.com/onsi/gomega` from 1.42.0 to 1.42.1
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.42.0...v1.42.1)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-version: 0.78.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/clock
  dependency-version: 1.76.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-version: 3.75.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-version: 0.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.42.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@rkoster @anujc25
Regenerate counterfeiter fakes with v6.12.2 (cloudfoundry#3799)
7cd0e1c 
Runs go generate ./... to bring all generated fakes in sync with the
counterfeiter version pinned in go.mod (v6.12.2). The main visible
change is that the generated Invocations() method no longer emits
per-field RLock/RUnlock calls, which is the output of the newer
counterfeiter version.

Co-authored-by: Anuj Chaudhari <chaudharianuj93@gmail.com>
@dependabot
[main](go): Bump the dependencies group with 4 updates (cloudfoundry#…
681d34c 
…3817)

Bumps the dependencies group with 4 updates: [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt), [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock), [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) and [code.cloudfoundry.org/tlsconfig](https://github.com/cloudfoundry/tlsconfig).


Updates `code.cloudfoundry.org/bytefmt` from 0.78.0 to 0.79.0
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.78.0...v0.79.0)

Updates `code.cloudfoundry.org/clock` from 1.76.0 to 1.77.0
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.76.0...v1.77.0)

Updates `code.cloudfoundry.org/lager/v3` from 3.75.0 to 3.76.0
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.75.0...v3.76.0)

Updates `code.cloudfoundry.org/tlsconfig` from 0.60.0 to 0.61.0
- [Release notes](https://github.com/cloudfoundry/tlsconfig/releases)
- [Commits](cloudfoundry/tlsconfig@v0.60.0...v0.61.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-version: 0.79.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/clock
  dependency-version: 1.77.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-version: 3.76.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@prkalle
Fix(ci): allow checkout of gated PR head SHA under actions/checkout (c…
6e0364c 
…loudfoundry#3820)

actions/checkout v7 now refuses to check out a pull_request_target ref
other than the safe default, to block pwn-request attacks. Our checkouts
of needs.get-sha.outputs.gitRef / inputs.gitRef are already gated by
get-sha's author-association and safe-to-test label checks, so opt back
in with allow-unsafe-pr-checkout: true on those two steps.

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>
@prkalle
Fix(ci): fix delete-env failures and add force-delete fallback (cloud…
9c5e2a0 
…foundry#3819)

bosh delete-deployment used an invalid --skip-drain flag, causing it to
silently fail every run and leaving bbl down to hit "umount: target is
busy" during its own deployment teardown. Fix the flag and add a
force-delete-env.sh fallback that tears down the director/jumpbox directly
via the GCP CPI when the graceful path can't recover (e.g. abandoned BOSH
tasks or a stuck task worker).

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>
@rkoster @anujc25
RFC0055 Identity-Aware Routing (cloudfoundry#3758)
178a2ce 
* Enhance add-access-rule command UX with intuitive name-based flags

This commit improves the user experience for the add-access-rule command
by replacing the positional GUID-based SELECTOR argument with intuitive
flags that accept human-readable names and support cross-space/org resolution.

Changes:

**Command Interface:**
- Remove positional SELECTOR argument (breaking change, acceptable for unreleased feature)
- Add new flags: --source-app, --source-space, --source-org, --source-any, --selector
- Support hierarchical name resolution:
  - --source-app APP_NAME (looks in current space)
  - --source-app APP_NAME --source-space SPACE (cross-space in current org)
  - --source-app APP_NAME --source-space SPACE --source-org ORG (cross-org)
  - --source-space SPACE (space-level rule)
  - --source-org ORG (org-level rule)
  - --source-any (allow any authenticated app)
  - --selector SELECTOR (raw GUID-based selector for advanced users)
- Validate exactly one primary source is specified
- Display verbose output showing resolved selector for transparency

**Terminology Update:**
- Rename all "target" terminology to "source" throughout codebase
- Access rules specify the source (who can access), not the target
- Update AccessRuleWithRoute.TargetName → SourceName
- Update resolveAccessRuleTarget() → resolveAccessRuleSource()
- Update access-rules list command table header: "target" → "source"

**Error Handling:**
- Provide helpful error messages when app not found in current space
- Suggest using --source-space and --source-org flags for cross-space/org access
- Follow CF CLI patterns from add-network-policy command

**Testing:**
- Add 17 comprehensive test cases for add-access-rule command
- Update 19 actor tests to use new SourceName field
- All tests passing (36/36)

**Domain Integration:**
- Add enforce_access_rules support to create-shared-domain and create-private-domain
- Add --enforce-access-rules and --access-rules-scope flags
- Update domain resource with new fields

Examples:

  # Simple case - app in current space
  cf add-access-rule allow-frontend apps.identity --source-app frontend-app --hostname backend

  # Cross-space access
  cf add-access-rule allow-other apps.identity --source-app api-client --source-space other-space --hostname backend

  # Cross-org access
  cf add-access-rule allow-prod apps.identity --source-app client --source-space prod-space --source-org prod-org --hostname api

  # Space-level rule
  cf add-access-rule allow-monitoring apps.identity --source-space monitoring --hostname api

  # Org-level rule
  cf add-access-rule allow-platform apps.identity --source-org platform --hostname shared-api

  # Any authenticated app
  cf add-access-rule allow-all apps.identity --source-any --hostname public-api

Related to: cloudfoundry/community#1438

* Remove access rule names per RFC updates

Per RFC commits 882b69a and 11752f2, access rules no longer have
user-provided names. They are identified by their selector only,
with labels/annotations used for metadata instead.

Changes:
- Removed RULE_NAME argument from add-access-rule command
- Removed Name field from AccessRule API resource
- Updated access-rules list to show 4 columns (route, selector, scope, source)
  - SourceName now represents resolved app/space/org name from selector
- Updated remove-access-rule to use --selector flag instead of rule name
- Renamed DeleteAccessRule() to DeleteAccessRuleBySelector()
- Updated all tests to remove Name field references

All tests passing.

* Refine access-rules output to show separate host, domain, and path columns

Changed table format from:
  route                    selector  scope  source
  backend.apps.identity    ...       app    frontend-app

To:
  host     domain          path     selector  scope  source
  backend  apps.identity            ...       app    frontend-app
  api      apps.identity   /metrics ...       space  monitoring

This provides better clarity by separating the route components into
individual columns, making it easier to scan and filter visually.

* Rebrand RFC terminology: access rules → route policies, selector → source

Complete terminology shift for identity-aware routing RFC implementation:

**Access Rules → Route Policies**
- API: /v3/access_rules → /v3/route_policies
- CLI commands:
  - cf access-rules → cf route-policies
  - cf add-access-rule → cf add-route-policy
  - cf remove-access-rule → cf remove-route-policy
- Domain flags: --enforce-access-rules → --enforce-route-policies
- Domain fields: enforce_access_rules → enforce_route_policies,
  access_rules_scope → route_policies_scope

**Selector → Source**
- API field: "selector" → "source"
- CLI flag: --selector → --source
- Query params: selectors → sources, selector_resource_guids → source_guids
- Table column headers: "selector/source" → "source/name"
- Internal types: AccessRule → RoutePolicy, AccessRuleWithRoute → RoutePolicyWithRoute
- Error types: AccessRuleNotFoundError → RoutePolicyNotFoundError

**Rationale (per RFC)**
- "Route policies" aligns with existing CF "network policies" terminology
- "Source" matches C2C network policy convention (source → destination)
- Improves clarity: policies define allowed sources that can reach routes
- Better mental model for users familiar with CF networking concepts

This is a breaking change but acceptable since RFC is pre-GA with only
POC/lab implementations. Clean terminology is preferred over backward
compatibility at this stage.

Co-authored-by: RFC Community <cloudfoundry/community#1438>
Aligns-with: cloudfoundry/community@be8d74c1

* Add name-based source flags to remove-route-policy

Extract source resolution flags (--source-app, --source-space, --source-org,
--source-any, --source) into a shared RoutePolicySourceFlags struct embedded
in both add-route-policy and remove-route-policy commands.

Previously remove-route-policy only accepted --source with a raw GUID-format
value (cf:app:<guid>, etc.), while add-route-policy supported name-based
resolution. The two commands now have matching flag sets.

* Add CAPI version check for route policy commands

Guard add-route-policy, remove-route-policy, and route-policies with an
unconditional MinimumCCAPIVersionCheck against MinVersionRoutePolicies.
Guard create-shared-domain and create-private-domain conditionally when
--enforce-route-policies is passed.

MinVersionRoutePolicies is currently a placeholder (3.999.0); a failing
test in ccversion/minimum_version_test.go keeps the TODO visible until the
real CAPI version is confirmed and the constant is updated.

* Add route policies column to cf domains output

Show a single 'route policies' column when the CAPI version supports it.
The column is blank for plain domains, 'enforced' when enforcement is on
with no scope, and 'enforced (org/space/any)' when a scope is set.

The column is gated on MinVersionRoutePolicies so it silently disappears
on older CAPI targets — no hard error, cf domains still works everywhere.

* Add cf/cli to .gitignore to prevent binary commits

* Add unit tests for route policy commands, actor, and ccv3 client

* Fix: reject --source-org with --source-app when --source-space is missing

When a user specifies --source-org with --source-app but omits --source-space,
validateSourceFlags() previously passed (treating --source-app as the sole
primary flag), and resolveSource() silently ignored --source-org, resolving
the app in the currently targeted space.

Add a pre-check in validateSourceFlags() that returns RequiredFlagsError
(--source-org and --source-space must be used together) whenever --source-org
is combined with --source-app but --source-space is absent.

* test: add scope/enforce coverage for CreatePrivateDomain in domain_test.go

Refactor CreatePrivateDomain describe block to use JustBeforeEach pattern
and add Context block for enforceAccessRules=true with non-empty scope,
mirroring the existing coverage in CreateSharedDomain.

* refactor: consolidate Add/RemoveRoutePolicyArgs into single RoutePolicyArgs

Three identical one-field structs replaced with a single shared type.
Description aligned with the existing convention in arguments.go.

* test: add dedicated tests for route_policy_source_flags and create-private-domain new flags

- route_policy_source_flags_test.go: covers all validateSourceFlags branches
  (no flags, single flags, qualifier combinations, RequiredFlagsError,
  ArgumentCombinationError) and all resolveSource paths (raw --source,
  --source-any, --source-app with/without cross-space/org, --source-space,
  --source-org, error propagation from each actor call)
- create_private_domain_command_test.go: adds coverage for --scope without
  --enforce-route-policies, invalid --scope values, API version check failure,
  --enforce-route-policies success (identity-aware TIP), and --scope forwarding

* test: add --enforce-route-policies and --scope coverage to create-shared-domain test

Mirrors the coverage added to create_private_domain_command_test.go:
- --scope without --enforce-route-policies returns an error
- invalid --scope value returns an error
- --enforce-route-policies with old API version returns MinimumCFAPIVersionNotMetError
- --enforce-route-policies success: identity-aware TIP, enforce=true passed to actor
- --enforce-route-policies + --scope: scope forwarded to actor
- default path now explicitly asserts enforce=false, scope empty

* refactor: extract shared --enforce-route-policies / --scope test behaviour

Introduce EnforceRoutePoliciesBehavior and ItEnforcesRoutePolicies in
enforce_route_policies_shared_test.go. Both create-shared-domain and
create-private-domain tests now delegate the duplicate When blocks to the
shared helper, parameterised only by TIPAdjective and the actor-specific
arg-extraction closures. ccversion and translatableerror imports removed from
both individual test files.

* chore: remove devbox.json and devbox.lock from tracked files

* Remove whitespace-only changes from unrelated files

Bulk find-and-replace tooling from the rebrand commit introduced
spaces→tabs indentation fixes and Invocations() mutex-lock removals
in files completely unrelated to the route-policies feature. Restore
all of them to origin/main to keep the feature diff focused.

* fix: guard AddRoutePolicy against non-enforcing domains

Add a client-side check in AddRoutePolicy that returns
DomainNotEnforcingRoutePoliciesError if the domain does not have
enforce_route_policies enabled, before attempting the API call.

CAPI already enforces this server-side (route_policies_controller.rb:129),
but the client-side guard provides a user-friendly error message with
the domain name rather than a GUID-based 422 response.

- Add actionerror.DomainNotEnforcingRoutePoliciesError
- Guard in actor/v7action/route_policy.go after domain fetch
- Update tests: set EnforceRoutePolicies on success-path domains
- Add new spec: When the domain does not enforce route policies

* refactor: move GetRoutesByDomain to route.go

Belongs alongside GetRoutesBySpace and GetRoutesByOrg rather than
in route_policy.go.

* refactor: simplify GetRoutesByDomain — drop redundant copy loop

ccv3.GetRoutes already returns []resources.Route directly;
the loop copying each element was a no-op identity conversion.

* feat: add -n short flag for --hostname on route policy commands

* refactor: extract resolveOrgGUID/resolveSpaceGUID to eliminate duplication

The org and space resolution blocks were duplicated between the
--source-app and --source-space branches of resolveSource. Extract
into standalone helpers. Add dedicated unit tests for each helper
plus the previously missing --source-space + --source-org error path.

* refactor: convert source flags test to package v7_test with v7fakes

Switch route_policy_source_flags_test.go from package v7 (internal
white-box test) to the standard package v7_test pattern used throughout
the command layer. Tests now use v7fakes.FakeActor via AddRoutePolicyCommand.Execute()
instead of an inline stub actor, which was required to work around the
circular import between package v7 and v7fakes.

resolveOrgGUID and resolveSpaceGUID are no longer tested in isolation
(they are unexported and not accessible from v7_test), but all their
code paths are covered by the resolveSource tests that exercise the full
flag-combination matrix through Execute().

* perf: use ?include=source to resolve policy source names in one API call

Replace resolveRoutePolicySource (which made a separate GetApplications/
GetSpaces/GetOrganizations call per policy) with sourceInfoFromIncluded,
a pure map lookup against resources returned by ?include=route,source.

CAPI's IncludeRoutePolicySourceDecorator already batches all referenced
app/space/org GUIDs into a single query and returns them inline, so the
route-policies command now resolves N source names with 0 extra API calls
regardless of how many policies are displayed.

* refactor: filter routes slice before map, pre-populate domain cache, add -d flag

T10: filter includedResources.Routes slice for all three conditions (domain/
hostname/path) before building routeByGUID, so the map is only populated from
matching routes.

T11: create domainCache before the filter block; when a domain filter is used,
pre-populate domainCache[domain.GUID] from the GetDomainByName result so the
subsequent cache-fill loop is a no-op for the common single-domain case.

T14: add short:'d' to the --domain flag on route-policies command.

Also replace hardcoded version string in route_policies_command_test.go with
ccversion.MinVersionRoutePolicies so the test stays valid when the constant
is updated.

* feat: register PATCH /v3/route_policies/:guid in CAPI metadata client

* feat: add RoutePolicyAmbiguityError for route-policy label disambiguation

* feat: implement GetRoutePolicyLabels and UpdateRoutePolicyLabels actor methods

- Add resolveRoutePolicyGUID helper to find policies with ambiguity/not-found error handling
- Implement GetRoutePolicyLabels to retrieve labels from route policies with optional source filtering
- Implement UpdateRoutePolicyLabels to set labels on route policies with optional source filtering
- Add comprehensive test coverage for success cases, error conditions, and edge cases
- All 1262 tests pass

* feat: add route-policy methods to Actor/SetLabelActor interfaces, regenerate fakes

* feat: add route-policy support to labels command and label updater

- Add RoutePolicy resource type to LabelsCommand.Execute() with GetRoutePolicyLabels() support
- Add RoutePolicy to LabelsCommand.checkTarget() and Resources() documentation
- Fix add_route_policy_command_test and remove_route_policy_command_test to expect correct API version 3.221.0
- Fix labels_command_test shared validation test to include route-policy in checkTarget expectations

All 2299 tests passing.

* feat: add route-policy support to cf labels command

* feat: add --source flag to set-label and unset-label commands

* fix: refactor testForResourceType helper to take explicit plural URI segment

* fix: remove orphaned comment fragment in route_policy_source_flags_test.go

* test: document that route-policy ResourceName is passed as-is to label setter

* test: document that route-policy ResourceName is passed as-is to label unsetter

* fix: remove duplicate RunSpecs in route_policy_resource_test.go

* refactor: move resolveRoutePolicyGUID to route_policy.go

The Get/UpdateRoutePolicyLabels wrappers in label.go follow the same
convention as every other resource (GetRouteLabels, GetDomainLabels,
etc.): the thin label wrapper stays in label.go and delegates GUID
resolution to a helper in the resource's own file. Move the
route-policy resolver alongside the other route-policy actor methods
and drop the now-unused ccv3 import from label.go.

* refactor: collapse resolveSource into a single org->space->app cascade

Replace the three separate --source-app/--source-space/--source-org
branches with one linear cascade: each level (org, then space, then app)
refines the GUID the next level resolves against, and the most specific
flag provided becomes the scope. The result is built once as
cf:<scope>:<guid>.

This removes the resolveOrgGUID/resolveSpaceGUID helpers, since GUID
resolution now happens exactly once per level inline. Source strings,
verbose scope output, warning ordering, and the app-not-found TIP error
are all unchanged; the existing black-box command specs cover them.

* fix: list route-policy in set-label and unset-label resource help

* feat: add -p short flag for --path on add/remove-route-policy

* Fix create-private-domain integration test SEE ALSO expectation

The related_commands tag on CreatePrivateDomainCommand was updated to
include add-route-policy and route-policies, but the integration test
still asserted the old SEE ALSO text, causing the help/usage specs to
time out waiting for a substring that no longer appears contiguously
in the rendered output.

* Set MinVersionRoutePolicies to the released CAPI version 3.224.0

capi-release 1.239.0 (https://github.com/cloudfoundry/capi-release/releases/tag/1.239.0)
ships RFC0055 Identity-Aware Routing with CC API version 3.224.0. Replace the
3.221.0 guess with the confirmed value, drop the now-obsolete placeholder
guard test, and have the command tests reference the constant instead of a
hardcoded string so they can't drift from it again.

---------

Co-authored-by: Anuj Chaudhari <chaudharianuj93@gmail.com>
@dependabot
[main](go): Bump the dependencies group with 7 updates (cloudfoundry#…
05194fe 
…3823)

Bumps the dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt) | `0.79.0` | `0.80.0` |
| [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) | `1.77.0` | `1.78.0` |
| [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) | `3.76.0` | `3.77.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.53.0` | `0.54.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.56.0` | `0.57.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.44.0` | `0.45.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.38.0` | `0.40.0` |


Updates `code.cloudfoundry.org/bytefmt` from 0.79.0 to 0.80.0
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.79.0...v0.80.0)

Updates `code.cloudfoundry.org/clock` from 1.77.0 to 1.78.0
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.77.0...v1.78.0)

Updates `code.cloudfoundry.org/lager/v3` from 3.76.0 to 3.77.0
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.76.0...v3.77.0)

Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
- [Commits](golang/crypto@v0.53.0...v0.54.0)

Updates `golang.org/x/net` from 0.56.0 to 0.57.0
- [Commits](golang/net@v0.56.0...v0.57.0)

Updates `golang.org/x/term` from 0.44.0 to 0.45.0
- [Commits](golang/term@v0.44.0...v0.45.0)

Updates `golang.org/x/text` from 0.38.0 to 0.40.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.38.0...v0.40.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-version: 0.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/clock
  dependency-version: 1.78.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-version: 3.77.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@prkalle
feat(ci): label bosh-lite GCP resources for tracking (cloudfoundry#3830)
9cb67c6 
Add belongs-to=cli / environment=<env> labels to the CF infra
resources CI provisions on GCP for tracking
- director VM: labels set via the google CPI (bosh-lite-vm-type.yml),
  with env_name threaded through create-director-override.sh
- director boot/persistent disks and the static external IP: labeled
  with gcloud in create-bosh-lite.yml (the CPI has no disk-label
  property, and the IP is created by bbl's terraform)

Labeling is best-effort so a labeling hiccup never tears down a good
env. VPC networks, subnets and firewall rules are intentionally not
labeled -- GCP does not support labels on those resource types.

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>
@dependabot
[main](go): Bump the dependencies group with 4 updates (cloudfoundry#…
6631e5d 
…3827)

Bumps the dependencies group with 4 updates: [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt), [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock), [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) and [code.cloudfoundry.org/tlsconfig](https://github.com/cloudfoundry/tlsconfig).


Updates `code.cloudfoundry.org/bytefmt` from 0.80.0 to 0.81.0
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.80.0...v0.81.0)

Updates `code.cloudfoundry.org/clock` from 1.78.0 to 1.79.0
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.78.0...v1.79.0)

Updates `code.cloudfoundry.org/lager/v3` from 3.77.0 to 3.78.0
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.77.0...v3.78.0)

Updates `code.cloudfoundry.org/tlsconfig` from 0.61.0 to 0.62.0
- [Release notes](https://github.com/cloudfoundry/tlsconfig/releases)
- [Commits](cloudfoundry/tlsconfig@v0.61.0...v0.62.0)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-version: 0.81.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/clock
  dependency-version: 1.79.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-version: 3.78.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-version: 0.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[main](gha): Bump actions/setup-go from 6 to 7 in the dependencies gr…
44a3abc 
…oup (cloudfoundry#3828)

Bumps the dependencies group with 1 update: [actions/setup-go](https://github.com/actions/setup-go).


Updates `actions/setup-go` from 6 to 7
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[main](go): Bump google.golang.org/grpc from 1.80.0 to 1.82.1 (cloudf…
b9d5564 
…oundry#3832)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.80.0 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.80.0...v1.82.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[main](go): Bump the dependencies group with 7 updates (cloudfoundry#…
b56ad35 
…3833)

Bumps the dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt) | `0.81.0` | `0.82.0` |
| [code.cloudfoundry.org/clock](https://github.com/cloudfoundry/clock) | `1.79.0` | `1.80.0` |
| [code.cloudfoundry.org/lager/v3](https://github.com/cloudfoundry/lager) | `3.78.0` | `3.79.0` |
| [code.cloudfoundry.org/tlsconfig](https://github.com/cloudfoundry/tlsconfig) | `0.62.0` | `0.63.0` |
| [github.com/mattn/go-runewidth](https://github.com/mattn/go-runewidth) | `0.0.24` | `0.0.27` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.2` | `0.36.3` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.2` | `0.36.3` |


Updates `code.cloudfoundry.org/bytefmt` from 0.81.0 to 0.82.0
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases)
- [Commits](cloudfoundry/bytefmt@v0.81.0...v0.82.0)

Updates `code.cloudfoundry.org/clock` from 1.79.0 to 1.80.0
- [Release notes](https://github.com/cloudfoundry/clock/releases)
- [Commits](cloudfoundry/clock@v1.79.0...v1.80.0)

Updates `code.cloudfoundry.org/lager/v3` from 3.78.0 to 3.79.0
- [Release notes](https://github.com/cloudfoundry/lager/releases)
- [Commits](cloudfoundry/lager@v3.78.0...v3.79.0)

Updates `code.cloudfoundry.org/tlsconfig` from 0.62.0 to 0.63.0
- [Release notes](https://github.com/cloudfoundry/tlsconfig/releases)
- [Commits](cloudfoundry/tlsconfig@v0.62.0...v0.63.0)

Updates `github.com/mattn/go-runewidth` from 0.0.24 to 0.0.27
- [Commits](mattn/go-runewidth@v0.0.24...v0.0.27)

Updates `k8s.io/apimachinery` from 0.36.2 to 0.36.3
- [Commits](kubernetes/apimachinery@v0.36.2...v0.36.3)

Updates `k8s.io/client-go` from 0.36.2 to 0.36.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.2...v0.36.3)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-version: 0.82.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/clock
  dependency-version: 1.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-version: 3.79.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-version: 0.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/mattn/go-runewidth
  dependency-version: 0.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[main](go): Bump the dependencies group with 3 updates (cloudfoundry#…
ccfd649 
…3835)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-version: 0.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/clock
  dependency-version: 1.81.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-version: 3.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@prkalle
Fix(curl): surface auth errors and avoid panic on nil HTTP response (c…
c604d09 
…loudfoundry#3839)

MakeCurlRequest assumed that a non-nil error always came with an HTTP
response (e.g. a 4xx/5xx from the API). That assumption breaks when the
request fails before reaching the API — for example a token refresh /
client-credentials authentication failure in the UAA request wrapper,
which returns an error with a nil *http.Response.

In that case:
- Without --fail, the error was swallowed and cf curl printed empty
  output, giving the user no indication anything went wrong.
- With --fail, the code dereferenced httpResponse.StatusCode on the nil
  response and panicked.

Only surface CurlExit22Error when an HTTP response is actually present;
when the response is nil, return the underlying error directly so the
user sees a real message (e.g. "Bad credentials") and cf curl exits
cleanly instead of panicking. Existing behavior for real HTTP error
responses (print body by default, fail only with --fail) is unchanged.

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>
@dependabot
[main](gha): Bump actions/stale (cloudfoundry#3837)
7e3a526 
Bumps the dependencies group with 1 update in the / directory: [actions/stale](https://github.com/actions/stale).


Updates `actions/stale` from 10 to 11
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@v10...v11)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: '11'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
[main](go): Bump the dependencies group across 1 directory with 4 upd…
fcb3492 
…ates (cloudfoundry#3841)

---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
  dependency-version: 0.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/clock
  dependency-version: 1.82.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/lager/v3
  dependency-version: 3.81.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: code.cloudfoundry.org/tlsconfig
  dependency-version: 0.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@benjaminguttmann-avtq
Migrate github.com/SermoDigital to github.com/golang-jwt for 1.27.0 c…
efcf9de 
…ompat
@linux-foundation-easycla

linux-foundation-easycla Bot commented Aug 26, 2026

Copy link
Copy Markdown

CLA Missing ID

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.