Bump the go-dependencies group with 8 updates

.github/dependabot.yml

@@ -5,16 +5,56 @@
 # documentation: https://docs.github.com/code-security/dependabot/dependabot-version-updates
 # schema documentation: https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
 # yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
+#
+# Dependabot allows only one schedule per package-ecosystem, directory, and target-branch.
+# Configurations that lack a "target-branch" field also affect security updates.
+#
+# There is a hack to have *two* schedules: https://github.com/dependabot/dependabot-core/issues/1778#issuecomment-1988140219
 ---
 version: 2
 updates:
   - package-ecosystem: github-actions
     directories:
+      # "/" is a special case that includes ".github/workflows/*"
       - '/'
       - '.github/actions/*'
     schedule:
       interval: weekly
       day: tuesday
+    labels:
+      - dependencies
+    groups:
+      # Group security updates into one pull request
+      action-vulnerabilities:
+        applies-to: security-updates
+        patterns: ['*']
+
+      # Group version updates into one pull request
+      github-actions:
+        applies-to: version-updates
+        patterns: ['*']
+
+  - package-ecosystem: gomod
+    directory: '/'
+    schedule:
+      interval: weekly
+      day: wednesday
+    labels:
+      - dependencies
     groups:
-      all-github-actions:
+      # Group security updates into one pull request
+      go-vulnerabilities:
+        applies-to: security-updates
+        patterns: ['*']
+
+      # Group Kubernetes and OpenTelemetry version updates into separate pull requests
+      kubernetes:
+        patterns: ['k8s.io/*', 'sigs.k8s.io/*']
+      opentelemetry:
+        patterns: ['go.opentelemetry.io/*']
+      go-dependencies:
         patterns: ['*']
+        exclude-patterns:
+          - 'k8s.io/*'
+          - 'sigs.k8s.io/*'
+          - 'go.opentelemetry.io/*'

go.mod

@@ -4,26 +4,26 @@ module github.com/crunchydata/postgres-operator
 go 1.24.0
 
 require (
-	github.com/go-logr/logr v1.4.2
+	github.com/go-logr/logr v1.4.3
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
-	github.com/kubernetes-csi/external-snapshotter/client/v8 v8.0.0
-	github.com/onsi/ginkgo/v2 v2.22.1
-	github.com/onsi/gomega v1.36.2
+	github.com/kubernetes-csi/external-snapshotter/client/v8 v8.2.0
+	github.com/onsi/ginkgo/v2 v2.23.4
+	github.com/onsi/gomega v1.36.3
 	github.com/pganalyze/pg_query_go/v5 v5.1.0
 	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.9.3
-	github.com/xdg-go/stringprep v1.0.2
+	github.com/xdg-go/stringprep v1.0.4
 	go.opentelemetry.io/contrib/exporters/autoexport v0.57.0
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0
 	go.opentelemetry.io/contrib/propagators/autoprop v0.57.0
 	go.opentelemetry.io/otel v1.32.0
 	go.opentelemetry.io/otel/sdk v1.32.0
 	go.opentelemetry.io/otel/trace v1.32.0
-	golang.org/x/crypto v0.36.0
-	golang.org/x/tools v0.30.0
-	gotest.tools/v3 v3.5.1
+	golang.org/x/crypto v0.38.0
+	golang.org/x/tools v0.31.0
+	gotest.tools/v3 v3.5.2
 	k8s.io/api v0.32.2
 	k8s.io/apimachinery v0.32.2
 	k8s.io/client-go v0.32.2
@@ -60,7 +60,7 @@ require (
 	github.com/google/cel-go v0.22.0 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
+	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -104,21 +104,22 @@ require (
 	go.opentelemetry.io/otel/sdk/log v0.8.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.32.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
+	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
-	golang.org/x/mod v0.23.0 // indirect
+	golang.org/x/mod v0.24.0 // indirect
 	golang.org/x/net v0.38.0 // indirect
 	golang.org/x/oauth2 v0.27.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/term v0.32.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
 	golang.org/x/time v0.7.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 // indirect
 	google.golang.org/grpc v1.68.0 // indirect
-	google.golang.org/protobuf v1.36.1 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect