Proposing release 0.9.0

[RainbowMango]

Changes since v0.8.0

Improvements

• Bump Kubernetes dependencies to v1.33.3. (@slashpai, chore: update k8s and prometheus dependencies #1687)
• Bump Kubernetes dependencies to v1.34.0. (@slashpai, chore: bump kind, image and k8s dependencies to latest #1712)

Bug fixes

• Fix APIService template to conditionally render insecureSkipTLSVerify field, preventing GitOps sync drift when value is false. (@pawl, fix: conditionally render insecureSkipTLSVerify in APIService template #1727)

Security

• Bump Golang version to v1.24.10 to address CVE-2025-47907, CVE-2025-47906. (@RainbowMango, Bump Golang version to v1.24.10 to address CVE-2025-47907, CVE-2025-47906 #1738)
• build(deps): bump golang.org/x/crypto from 0.39.0 to 0.45.0. (@dependabot, build(deps): bump golang.org/x/crypto from 0.39.0 to 0.45.0 #1737)

Others

• Use repository default branch in chart-testing workflow. (@RainbowMango, Use repository default branch in chart-testing workflow #1684)
• chore: bump golangci-lint version to 2.4.0. (@slashpai, chore: bump golangci-lint version to 2.4.0 #1713)
• chore: Bump golangci-lint to v2.3.0. (@slashpai, 1686)
• build(deps): bump mikefarah/yq from 4.46.1 to 4.47.1. (@dependabot, build(deps): bump mikefarah/yq from 4.46.1 to 4.47.1 #1694)
• build(deps): bump github.com/onsi/gomega from 1.37.0 to 1.38.0 in the gomod-dependencies group. (@dependabot, build(deps): bump github.com/onsi/gomega from 1.37.0 to 1.38.0 in the gomod-dependencies group #1693)
• build(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7. (@dependabot, build(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7 in the gomod-dependencies group across 1 directory #1690)
• build(deps): bump mikefarah/yq from 4.45.4 to 4.46.1. (@dependabot, build(deps): bump mikefarah/yq from 4.45.4 to 4.46.1 #1682)
• feat(chart): update chart for v0.8.0. (@stevehipwell, feat(chart): update chart for v0.8.0 #1683)
• build(deps): bump golang from 1.24.4 to 1.24.5. (@dependabot, build(deps): bump golang from 1.24.4 to 1.24.5 #1681)
• Add slashpai and RainbowMango as reviewers. (@dgrisonnet, Add slashpai and RainbowMango as reviewers #1679)
• chore: Use go tools. (@mrueg, chore: Use go tools #1648)

[serathius]

Don't see any changes that would motivate minor release. Why do you think dependency updates are worth a minor update?

[RainbowMango]

yeah, good point! A patch release will do.

[RainbowMango]

/retitle Proposing release 0.8.1

[serathius]

Are you sure you covered changes included in release-0.8...master ?

[RainbowMango]

No. The v0.8.0 was cut from master, so I grabbed the changes from v0.8.0...master.

• If we are going to cut a patch release, I guess it should be from the release-0.8. We can do that by cherry-picking some PR that fixes bugs, security concerns (fix: conditionally render insecureSkipTLSVerify in APIService template #1727, build(deps): bump golang.org/x/crypto from 0.39.0 to 0.45.0 #1737, Bump Golang version to v1.24.10 to address CVE-2025-47907, CVE-2025-47906 #1738).
• If we are going to cut a minor release, I guess it should be from master.
  • In my opinion, Kubernetes dependencies update is not a typical feature, but it provide better compatibility for higher versions of Kubernetes. Therefore, we can also perform a minor version.

Anyway, it's your call.

[Llois41]

Could you please update the go version to at least 1.24.9 to fix CVE-2025-58186 & CVE-2025-58187. Would be nice to have those fixes included in the next release :)

[serathius]

Contributions are welcome

[RainbowMango]

@Llois41 @serathius Here is the PR for updating Go to v1.24.10. #1738

[dgrisonnet]

I wouldn't cut a new minor version because there wasn't any new major changes/improvements to metrics-server and both the Kubernetes and Golang dependencies are still on supported version. Given no major changes are made, we should release 0.9.0 when Kubernetes 1.36 and Golang 1.26 are out.

As for a new patch release, #1727 is a helm chart change so it can be released independently of metrics-server. But I'd fine with cutting a new patch release with updated golang dependencies to get rid of a couple of CVEs since the last release of metrics-server was almost 6 months ago.

[stevehipwell]

I'm waiting for #1715 to be merged before cutting Helm chart releases, that way we don't need to cherry pick into the release branch for a Helm chart change.

[RainbowMango]

Given no major changes are made, we should release 0.9.0 when Kubernetes 1.36 and Golang 1.26 are out.

Makes sense to me.