Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package velero for openSUSE:Factory checked in at 2026-09-29 17:51:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/velero (Old) and /work/SRC/openSUSE:Factory/.velero.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "velero" Tue Sep 29 17:51:01 2026 rev:41 rq:1381293 version:1.18.4 Changes: -------- --- /work/SRC/openSUSE:Factory/velero/velero.changes 2026-09-22 15:53:06.516959593 +0200 +++ /work/SRC/openSUSE:Factory/.velero.new.383539/velero.changes 2026-09-29 17:53:21.057154259 +0200 @@ -1,0 +2,13 @@ +Tue Sep 29 04:53:39 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.18.4: + * Fix CVEs for v1.18.4 + - Bump go.opentelemetry.io/otel/sdk to 1.45.0 to fix + CVE-2026-81870 + - Bump google.golang.org/grpc to 1.83.2 to fix CVE-2026-84445 + - Bump paketobuildpacks/run-jammy-tiny to 0.2.177 + * Pin e2e third-party clones to reviewed commits + * Fix backup queue permanently stuck when a dequeued backup + completes during the patch (#10521) + +------------------------------------------------------------------- Old: ---- velero-1.18.3.obscpio New: ---- velero-1.18.4.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ velero.spec ++++++ --- /var/tmp/diff_new_pack.QRJCX8/_old 2026-09-29 17:53:23.326248996 +0200 +++ /var/tmp/diff_new_pack.QRJCX8/_new 2026-09-29 17:53:23.328249079 +0200 @@ -17,7 +17,7 @@ Name: velero -Version: 1.18.3 +Version: 1.18.4 Release: 0 Summary: Backup program with deduplication and encryption License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.QRJCX8/_old 2026-09-29 17:53:23.366250666 +0200 +++ /var/tmp/diff_new_pack.QRJCX8/_new 2026-09-29 17:53:23.372250917 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/vmware-tanzu/velero.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.18.3</param> + <param name="revision">refs/tags/v1.18.4</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.QRJCX8/_old 2026-09-29 17:53:23.404252253 +0200 +++ /var/tmp/diff_new_pack.QRJCX8/_new 2026-09-29 17:53:23.407252378 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/vmware-tanzu/velero</param> <param name="changesrevision">26ef8fa7df68dfa9ab8aa4669b8ac47340b0c510</param></service><service name="tar_scm"> <param name="url">https://github.com/vmware-tanzu/velero.git</param> - <param name="changesrevision">cd3fd10b093dad32ee284e27fcba4e9073c9c94b</param></service></servicedata> + <param name="changesrevision">4ee1e79a7aed367fd9b767b8219ec65bd0c96892</param></service></servicedata> (No newline at EOF) ++++++ velero-1.18.3.obscpio -> velero-1.18.4.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/velero-1.18.3/Dockerfile new/velero-1.18.4/Dockerfile --- old/velero-1.18.3/Dockerfile 2026-09-08 10:33:42.000000000 +0200 +++ new/velero-1.18.4/Dockerfile 2026-09-24 09:50:44.000000000 +0200 @@ -73,7 +73,7 @@ go clean -modcache -cache # Velero image packing section -FROM paketobuildpacks/run-jammy-tiny:0.2.165 +FROM paketobuildpacks/run-jammy-tiny:0.2.177 LABEL maintainer="Xun Jiang <[email protected]>" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/velero-1.18.3/changelogs/CHANGELOG-1.18.md new/velero-1.18.4/changelogs/CHANGELOG-1.18.md --- old/velero-1.18.3/changelogs/CHANGELOG-1.18.md 2026-09-08 10:33:42.000000000 +0200 +++ new/velero-1.18.4/changelogs/CHANGELOG-1.18.md 2026-09-24 09:50:44.000000000 +0200 @@ -1,3 +1,21 @@ +## v1.18.4 + +### Download +https://github.com/vmware-tanzu/velero/releases/tag/v1.18.4 + +### Container Image +`velero/velero:v1.18.4` + +### Documentation +https://velero.io/docs/v1.18/ + +### Upgrading +https://velero.io/docs/v1.18/upgrade-to-1.18/ + +### All Changes + * Fix backup queue permanently stuck when a dequeued backup completes during the patch (#10539, @pujitha24) + + ## v1.18.3 ### Download diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/velero-1.18.3/go.mod new/velero-1.18.4/go.mod --- old/velero-1.18.3/go.mod 2026-09-08 10:33:42.000000000 +0200 +++ new/velero-1.18.4/go.mod 2026-09-24 09:50:44.000000000 +0200 @@ -48,7 +48,7 @@ golang.org/x/sys v0.47.0 golang.org/x/text v0.41.0 google.golang.org/api v0.283.0 - google.golang.org/grpc v1.83.1 + google.golang.org/grpc v1.83.2 google.golang.org/protobuf v1.36.11 k8s.io/api v0.33.12 k8s.io/apiextensions-apiserver v0.33.12 @@ -111,7 +111,7 @@ github.com/getsentry/sentry-go v0.46.0 // indirect github.com/go-ini/ini v1.67.0 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect - github.com/go-logr/logr v1.4.3 // indirect + github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-ole/go-ole v1.3.0 // indirect github.com/go-openapi/jsonpointer v0.21.0 // indirect @@ -183,11 +183,11 @@ go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect - go.opentelemetry.io/otel v1.44.0 // indirect - go.opentelemetry.io/otel/metric v1.44.0 // indirect - go.opentelemetry.io/otel/sdk v1.44.0 // indirect - go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect - go.opentelemetry.io/otel/trace v1.44.0 // indirect + go.opentelemetry.io/otel v1.45.0 // indirect + go.opentelemetry.io/otel/metric v1.45.0 // indirect + go.opentelemetry.io/otel/sdk v1.45.0 // indirect + go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect + go.opentelemetry.io/otel/trace v1.45.0 // indirect go.starlark.net v0.0.0-20241226192728-8dfa5b98479f // indirect go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/velero-1.18.3/go.sum new/velero-1.18.4/go.sum --- old/velero-1.18.3/go.sum 2026-09-08 10:33:42.000000000 +0200 +++ new/velero-1.18.4/go.sum 2026-09-24 09:50:44.000000000 +0200 @@ -178,8 +178,8 @@ github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= @@ -446,20 +446,20 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU= +go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ= go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY= go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA= -go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= -go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= -go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= +go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M= +go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s= +go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns= +go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI= +go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw= +go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA= +go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o= +go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA= +go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag= +go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc= go.starlark.net v0.0.0-20241226192728-8dfa5b98479f h1:Zs/py28HDFATSDzPcfIzrBFjVsV7HzDEGNNVZIGsjm0= go.starlark.net v0.0.0-20241226192728-8dfa5b98479f/go.mod h1:YKMCv9b1WrfWmeqdV5MAuEHWsu5iC+fe6kYl2sQjdI8= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -539,8 +539,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY= google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= -google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/velero-1.18.3/hack/fix_restic_cve.txt new/velero-1.18.4/hack/fix_restic_cve.txt --- old/velero-1.18.3/hack/fix_restic_cve.txt 2026-09-08 10:33:42.000000000 +0200 +++ new/velero-1.18.4/hack/fix_restic_cve.txt 2026-09-24 09:50:44.000000000 +0200 @@ -1,5 +1,5 @@ diff --git a/go.mod b/go.mod -index 5f939c481..537ec2d68 100644 +index 5f939c481..70fda3870 100644 --- a/go.mod +++ b/go.mod @@ -1,15 +1,15 @@ @@ -34,7 +34,7 @@ - golang.org/x/text v0.6.0 - google.golang.org/api v0.106.0 + golang.org/x/crypto v0.56.0 -+ golang.org/x/net v0.57.0 ++ golang.org/x/net v0.58.0 + golang.org/x/oauth2 v0.36.0 + golang.org/x/sync v0.22.0 + golang.org/x/sys v0.47.0 @@ -70,7 +70,7 @@ - github.com/golang/protobuf v1.5.2 // indirect + github.com/felixge/httpsnoop v1.0.4 // indirect + github.com/go-jose/go-jose/v4 v4.1.4 // indirect -+ github.com/go-logr/logr v1.4.3 // indirect ++ github.com/go-logr/logr v1.4.4 // indirect + github.com/go-logr/stdr v1.2.2 // indirect github.com/google/pprof v0.0.0-20230111200839-76d1ae5aea2b // indirect - github.com/google/uuid v1.3.0 // indirect @@ -102,16 +102,16 @@ + go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect + go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect -+ go.opentelemetry.io/otel v1.44.0 // indirect -+ go.opentelemetry.io/otel/metric v1.44.0 // indirect -+ go.opentelemetry.io/otel/sdk v1.44.0 // indirect -+ go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect -+ go.opentelemetry.io/otel/trace v1.44.0 // indirect ++ go.opentelemetry.io/otel v1.45.0 // indirect ++ go.opentelemetry.io/otel/metric v1.45.0 // indirect ++ go.opentelemetry.io/otel/sdk v1.45.0 // indirect ++ go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect ++ go.opentelemetry.io/otel/trace v1.45.0 // indirect + golang.org/x/time v0.15.0 // indirect + google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect -+ google.golang.org/grpc v1.83.1 // indirect ++ google.golang.org/grpc v1.83.2 // indirect + google.golang.org/protobuf v1.36.11 // indirect gopkg.in/ini.v1 v1.67.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect @@ -120,7 +120,7 @@ -go 1.18 +go 1.26.0 diff --git a/go.sum b/go.sum -index 026e1d2fa..beb2875b2 100644 +index 026e1d2fa..496afbdd4 100644 --- a/go.sum +++ b/go.sum @@ -1,42 +1,61 @@ @@ -227,8 +227,8 @@ +github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= +github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= ++github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= ++github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY= @@ -364,20 +364,20 @@ +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg= -+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= ++go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU= ++go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ= +go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY= +go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw= -+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -+go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA= -+go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk= -+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= -+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= -+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= ++go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M= ++go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s= ++go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns= ++go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI= ++go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw= ++go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA= ++go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o= ++go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA= ++go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag= ++go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= @@ -408,8 +408,8 @@ -golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec= -golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= ++golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= ++golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= +golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -504,8 +504,8 @@ +google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -+google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= -+google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= ++google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= ++google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= +google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= +google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/velero-1.18.3/pkg/controller/backup_queue_controller.go new/velero-1.18.4/pkg/controller/backup_queue_controller.go --- old/velero-1.18.3/pkg/controller/backup_queue_controller.go 2026-09-08 10:33:42.000000000 +0200 +++ new/velero-1.18.4/pkg/controller/backup_queue_controller.go 2026-09-24 09:50:44.000000000 +0200 @@ -272,7 +272,7 @@ } lister := r.newQueuedBackupsLister(allBackups) if r.backupTracker.RunningCount() >= r.concurrentBackups { - log.Debugf("%v concurrent backups are already running, leaving %v queued", r.concurrentBackups, backup.Name) + log.Infof("%v concurrent backups are already running, leaving %v queued", r.concurrentBackups, backup.Name) return ctrl.Result{}, nil } earlierBackups := lister.earlierThan(backup.Status.QueuePosition) @@ -294,10 +294,15 @@ original := backup.DeepCopy() backup.Status.Phase = velerov1api.BackupPhaseReadyToStart backup.Status.QueuePosition = 0 + // Record ReadyToStart before patching: patching first would let + // backupReconciler pick up the change and complete the backup + // (Add then deferred Delete) before this call, leaking a + // tracker entry that nothing would ever clean up. + r.backupTracker.AddReadyToStart(backup.Namespace, backup.Name) if err := kube.PatchResource(original, backup, r.Client); err != nil { + r.backupTracker.Delete(backup.Namespace, backup.Name) return ctrl.Result{}, errors.Wrapf(err, "error updating Backup status to %s", backup.Status.Phase) } - r.backupTracker.AddReadyToStart(backup.Namespace, backup.Name) log.Debug("Updating queuePosition for remaining queued backups") queuedBackups := lister.orderedQueued() newQueuePos := 1 @@ -306,7 +311,7 @@ original := queuedBackup.DeepCopy() queuedBackup.Status.QueuePosition = newQueuePos if err := kube.PatchResource(original, &queuedBackup, r.Client); err != nil { - log.WithError(errors.Wrapf(err, "error updating Backup %s queuePosition to %v", queuedBackup.Name, newQueuePos)) + log.WithError(err).Errorf("error updating Backup %s queuePosition to %v", queuedBackup.Name, newQueuePos) return ctrl.Result{}, nil } newQueuePos++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/velero-1.18.3/pkg/controller/backup_queue_controller_test.go new/velero-1.18.4/pkg/controller/backup_queue_controller_test.go --- old/velero-1.18.3/pkg/controller/backup_queue_controller_test.go 2026-09-08 10:33:42.000000000 +0200 +++ new/velero-1.18.4/pkg/controller/backup_queue_controller_test.go 2026-09-24 09:50:44.000000000 +0200 @@ -17,6 +17,8 @@ package controller import ( + "context" + "errors" "testing" "github.com/sirupsen/logrus" @@ -27,8 +29,10 @@ "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/types" ctrl "sigs.k8s.io/controller-runtime" + ctrlClient "sigs.k8s.io/controller-runtime/pkg/client" //"sigs.k8s.io/controller-runtime/pkg/client/fake" + "sigs.k8s.io/controller-runtime/pkg/client/interceptor" velerov1api "github.com/vmware-tanzu/velero/pkg/apis/velero/v1" "github.com/vmware-tanzu/velero/pkg/builder" @@ -239,3 +243,81 @@ }) } } + +// TestBackupQueueReconcilerTrackerNotLeakedWhenBackupCompletesDuringPatch verifies the fix for +// https://github.com/velero-io/velero/issues/10519: if backupReconciler picks up the +// ReadyToStart phase change (e.g. because the backup fails validation immediately) and calls +// BackupTracker.Add/Delete before backupQueueReconciler reaches its own AddReadyToStart call, +// the queue controller must not re-insert a tracker entry nobody will ever delete. +func TestBackupQueueReconcilerTrackerNotLeakedWhenBackupCompletesDuringPatch(t *testing.T) { + scheme := runtime.NewScheme() + require.NoError(t, velerov1api.AddToScheme(scheme)) + + backup := builder.ForBackup(velerov1api.DefaultNamespace, "backup-11").Phase(velerov1api.BackupPhaseQueued).QueuePosition(1).Result() + backupTracker := NewBackupTracker() + + fakeClient := velerotest.NewFakeControllerRuntimeClientBuilder(t). + WithRuntimeObjects(backup). + WithInterceptorFuncs(interceptor.Funcs{ + Patch: func(ctx context.Context, c ctrlClient.WithWatch, obj ctrlClient.Object, patch ctrlClient.Patch, opts ...ctrlClient.PatchOption) error { + if err := c.Patch(ctx, obj, patch, opts...); err != nil { + return err + } + // Simulate backupReconciler racing ahead of this goroutine: it sees + // the ReadyToStart patch land, runs, and immediately completes the + // backup (e.g. FailedValidation), calling Add then its deferred + // Delete before backupQueueReconciler's next statement executes. + if b, ok := obj.(*velerov1api.Backup); ok && b.Status.Phase == velerov1api.BackupPhaseReadyToStart { + backupTracker.Add(b.Namespace, b.Name) + backupTracker.Delete(b.Namespace, b.Name) + } + return nil + }, + }). + Build() + + logger := logrus.New() + log := logger.WithField("controller", "backup-queue-test") + r := NewBackupQueueReconciler(fakeClient, scheme, log, 1, backupTracker) + req := ctrl.Request{NamespacedName: types.NamespacedName{Namespace: backup.Namespace, Name: backup.Name}} + _, err := r.Reconcile(t.Context(), req) + require.NoError(t, err) + + assert.Equal(t, 0, backupTracker.RunningCount(), + "tracker entry must not be leaked when a racing reconcile completes the backup before AddReadyToStart runs") +} + +// TestBackupQueueReconcilerTrackerRolledBackWhenPatchFails verifies that if the +// ReadyToStart patch itself fails, the AddReadyToStart call made just before it is +// rolled back via Delete, so a failed patch doesn't itself permanently consume a +// concurrency slot. +func TestBackupQueueReconcilerTrackerRolledBackWhenPatchFails(t *testing.T) { + scheme := runtime.NewScheme() + require.NoError(t, velerov1api.AddToScheme(scheme)) + + backup := builder.ForBackup(velerov1api.DefaultNamespace, "backup-11").Phase(velerov1api.BackupPhaseQueued).QueuePosition(1).Result() + backupTracker := NewBackupTracker() + + patchErr := errors.New("simulated patch failure") + fakeClient := velerotest.NewFakeControllerRuntimeClientBuilder(t). + WithRuntimeObjects(backup). + WithInterceptorFuncs(interceptor.Funcs{ + Patch: func(ctx context.Context, c ctrlClient.WithWatch, obj ctrlClient.Object, patch ctrlClient.Patch, opts ...ctrlClient.PatchOption) error { + if b, ok := obj.(*velerov1api.Backup); ok && b.Status.Phase == velerov1api.BackupPhaseReadyToStart { + return patchErr + } + return c.Patch(ctx, obj, patch, opts...) + }, + }). + Build() + + logger := logrus.New() + log := logger.WithField("controller", "backup-queue-test") + r := NewBackupQueueReconciler(fakeClient, scheme, log, 1, backupTracker) + req := ctrl.Request{NamespacedName: types.NamespacedName{Namespace: backup.Namespace, Name: backup.Name}} + _, err := r.Reconcile(t.Context(), req) + require.Error(t, err) + + assert.Equal(t, 0, backupTracker.RunningCount(), + "tracker entry must be rolled back when the ReadyToStart patch fails") +} ++++++ velero.obsinfo ++++++ --- /var/tmp/diff_new_pack.QRJCX8/_old 2026-09-29 17:53:25.617344652 +0200 +++ /var/tmp/diff_new_pack.QRJCX8/_new 2026-09-29 17:53:25.623344902 +0200 @@ -1,5 +1,5 @@ name: velero -version: 1.18.3 -mtime: 1788856422 -commit: cd3fd10b093dad32ee284e27fcba4e9073c9c94b +version: 1.18.4 +mtime: 1790236244 +commit: 4ee1e79a7aed367fd9b767b8219ec65bd0c96892 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/velero/vendor.tar.gz /work/SRC/openSUSE:Factory/.velero.new.383539/vendor.tar.gz differ: char 16, line 1
