Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.10 to 4.31.11.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdefb33...19b2f06)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.22.4 to 0.23.0.
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.22.4...v0.23.0)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [github/codeql-action](https://github.com/github/codeql-action)
from 4.31.10 to 4.31.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.31.11</h2>
<ul>
<li>When running a Default Setup workflow with <a
href="https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging">Actions
debugging enabled</a>, the CodeQL Action will now use more unique names
when uploading logs from the Dependabot authentication proxy as workflow
artifacts. This ensures that the artifact names do not clash between
multiple jobs in a build matrix. <a
href="https://redirect.github.com/github/codeql-action/pull/3409">#3409</a></li>
<li>Improved error handling throughout the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3415">#3415</a></li>
<li>Added experimental support for automatically excluding <a
href="https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github">generated
files</a> from the analysis. This feature is not currently enabled for
any analysis. In the future, it may be enabled by default for some
GitHub-managed analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3318">#3318</a></li>
<li>The changelog extracts that are included with releases of the CodeQL
Action are now shorter to avoid duplicated information from appearing in
Dependabot PRs. <a
href="https://redirect.github.com/github/codeql-action/pull/3403">#3403</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.31.11 - 23 Jan 2026</h2>
<ul>
<li>When running a Default Setup workflow with <a
href="https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging">Actions
debugging enabled</a>, the CodeQL Action will now use more unique names
when uploading logs from the Dependabot authentication proxy as workflow
artifacts. This ensures that the artifact names do not clash between
multiple jobs in a build matrix. <a
href="https://redirect.github.com/github/codeql-action/pull/3409">#3409</a></li>
<li>Improved error handling throughout the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3415">#3415</a></li>
<li>Added experimental support for automatically excluding <a
href="https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github">generated
files</a> from the analysis. This feature is not currently enabled for
any analysis. In the future, it may be enabled by default for some
GitHub-managed analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3318">#3318</a></li>
<li>The changelog extracts that are included with releases of the CodeQL
Action are now shorter to avoid duplicated information from appearing in
Dependabot PRs. <a
href="https://redirect.github.com/github/codeql-action/pull/3403">#3403</a></li>
</ul>
<h2>4.31.10 - 12 Jan 2026</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.9. <a
href="https://redirect.github.com/github/codeql-action/pull/3393">#3393</a></li>
</ul>
<h2>4.31.9 - 16 Dec 2025</h2>
<p>No user facing changes.</p>
<h2>4.31.8 - 11 Dec 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.8. <a
href="https://redirect.github.com/github/codeql-action/pull/3354">#3354</a></li>
</ul>
<h2>4.31.7 - 05 Dec 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.7. <a
href="https://redirect.github.com/github/codeql-action/pull/3343">#3343</a></li>
</ul>
<h2>4.31.6 - 01 Dec 2025</h2>
<p>No user facing changes.</p>
<h2>4.31.5 - 24 Nov 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.6. <a
href="https://redirect.github.com/github/codeql-action/pull/3321">#3321</a></li>
</ul>
<h2>4.31.4 - 18 Nov 2025</h2>
<p>No user facing changes.</p>
<h2>4.31.3 - 13 Nov 2025</h2>
<ul>
<li>CodeQL Action v3 will be deprecated in December 2026. The Action now
logs a warning for customers who are running v3 but could be running v4.
For more information, see <a
href="https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/">Upcoming
deprecation of CodeQL Action v3</a>.</li>
<li>Update default CodeQL bundle version to 2.23.5. <a
href="https://redirect.github.com/github/codeql-action/pull/3288">#3288</a></li>
</ul>
<h2>4.31.2 - 30 Oct 2025</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/19b2f06db2b6f5108140aeb04014ef02b648f789"><code>19b2f06</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3417">#3417</a>
from github/update-v4.31.11-1601acf88</li>
<li><a
href="https://github.com/github/codeql-action/commit/03afde035d183ba80e8e96944c488a8e8ad91c18"><code>03afde0</code></a>
Add noteworthy changes to changelog</li>
<li><a
href="https://github.com/github/codeql-action/commit/9469107033db53628a34cb02dd6367cbb03c5761"><code>9469107</code></a>
Update changelog for v4.31.11</li>
<li><a
href="https://github.com/github/codeql-action/commit/1601acf88bfbe2de76e2082e68fe84478525f68e"><code>1601acf</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3415">#3415</a>
from github/henrymercer/address-telemetry-gap</li>
<li><a
href="https://github.com/github/codeql-action/commit/fba78720cab61bc9326b24527e56282372bf34d3"><code>fba7872</code></a>
Address review comments</li>
<li><a
href="https://github.com/github/codeql-action/commit/a8dd5ab7a409e69ae1f5e757dc076cd837a978b9"><code>a8dd5ab</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3414">#3414</a>
from github/dependabot/npm_and_yarn/lodash-4.17.23</li>
<li><a
href="https://github.com/github/codeql-action/commit/28bfb7b7b5f8d7bf79201f61ac2996b0520e94a1"><code>28bfb7b</code></a>
Omit error from start-proxy Action</li>
<li><a
href="https://github.com/github/codeql-action/commit/91f34600061a8983d393b3104c28084fbadcb130"><code>91f3460</code></a>
Throw if in test mode</li>
<li><a
href="https://github.com/github/codeql-action/commit/edebb7861e8219e81797292963b8dfe2e441587e"><code>edebb78</code></a>
Differentiate unhandled errors in telemetry</li>
<li><a
href="https://github.com/github/codeql-action/commit/529c266223a58cd393dfc219b43361393a51887f"><code>529c266</code></a>
Use <code>getErrorMessage</code> in more places</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/cdefb33c0f6224e58673d9004f47f7cb3e328b89...19b2f06db2b6f5108140aeb04014ef02b648f789">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4.31.10&new-version=4.31.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1
to 6.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID
is set by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p>
<h2>v6.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update all references from v5 and v4 to v6 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
<li>Clarify v6 README by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>v6-beta by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li>
<li>update readme/changelog for v6 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p>
<h2>v6-beta</h2>
<h2>What's Changed</h2>
<p>Updated persist-credentials to store the credentials under
<code>$RUNNER_TEMP</code> instead of directly in the local git
config.</p>
<p>This requires a minimum Actions Runner version of <a
href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a>
to access the persisted credentials for <a
href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker
container action</a> scenarios.</p>
<h2>v5.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
<li>Prepare v5.0.0 release by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li>
</ul>
<h2>⚠️ Minimum Compatible Runner Version</h2>
<p><strong>v2.327.1</strong><br />
<a
href="https://github.com/actions/runner/releases/tag/v2.327.1">Release
Notes</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>v4.2.0</h2>
<ul>
<li>Add Ref and Commit outputs by <a
href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
<li>Dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
<a
href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
</ul>
<h2>v4.1.7</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
<li>Pin actions/checkout's own workflows to a known, good, stable
version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
</ul>
<h2>v4.1.6</h2>
<ul>
<li>Check platform to set archive extension appropriately by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd"><code>de0fac2</code></a>
Fix tag handling: preserve annotations and explicit fetch-tags (<a
href="https://redirect.github.com/actions/checkout/issues/2356">#2356</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49"><code>064fe7f</code></a>
Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is
set (...</li>
<li><a
href="https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8"><code>8e8c483</code></a>
Clarify v6 README (<a
href="https://redirect.github.com/actions/checkout/issues/2328">#2328</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1"><code>033fa0d</code></a>
Add worktree support for persist-credentials includeIf (<a
href="https://redirect.github.com/actions/checkout/issues/2327">#2327</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5"><code>c2d88d3</code></a>
Update all references from v5 and v4 to v6 (<a
href="https://redirect.github.com/actions/checkout/issues/2314">#2314</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a>
update readme/changelog for v6 (<a
href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a>
v6-beta (<a
href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a>
Persist creds to a separate file (<a
href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a>
Update README to include Node.js 24 support details and requirements (<a
href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a>
Prepare v5.0.0 release (<a
href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=4.3.1&new-version=6.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

…-runtime-0.23.0

#78)

Bumps
[sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime)
from 0.22.4 to 0.23.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kubernetes-sigs/controller-runtime/releases">sigs.k8s.io/controller-runtime's
releases</a>.</em></p>
<blockquote>
<h2>v0.23.0</h2>
<h2>🔆 Highlights</h2>
<ul>
<li>Client: Add subresource Apply support by <a
href="https://github.com/alvaroaleman"><code>@​alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3321">kubernetes-sigs/controller-runtime#3321</a></li>
<li>Conversion: Enable implementation of conversion outside of API
packages by <a
href="https://github.com/sbueringer"><code>@​sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3335">kubernetes-sigs/controller-runtime#3335</a></li>
<li>Priorityqueue: Various improvements, bug fixes and now enabled per
default</li>
<li>Webhooks: Generic Validator and Defaulter by <a
href="https://github.com/alvaroaleman"><code>@​alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3360">kubernetes-sigs/controller-runtime#3360</a></li>
</ul>
<h2>⚠️ Breaking changes</h2>
<ul>
<li>Dependencies: Update to k8s.io/* v1.35 by <a
href="https://github.com/alvaroaleman"><code>@​alvaroaleman</code></a>
<a
href="https://github.com/dongjiang1989"><code>@​dongjiang1989</code></a>
<a href="https://github.com/kannon92"><code>@​kannon92</code></a> (<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3316">#3316</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3349">#3349</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3386">#3386</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3391">#3391</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3401">#3401</a>)</li>
<li>Client: Add subresource Apply support by <a
href="https://github.com/alvaroaleman"><code>@​alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3321">kubernetes-sigs/controller-runtime#3321</a></li>
<li>Events: Migration to the new events API by <a
href="https://github.com/clebs"><code>@​clebs</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3262">kubernetes-sigs/controller-runtime#3262</a>
<ul>
<li>Using the new <code>GetEventRecorderFor</code> requires updating
your rbac for events to use the <code>events.k8s.io</code> apiGroup
rather than the `` (core) apiGroup</li>
</ul>
</li>
<li>Fakeclient: Set ResourceVersion for SSA Create by <a
href="https://github.com/alvaroaleman"><code>@​alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3311">kubernetes-sigs/controller-runtime#3311</a></li>
<li>Webhooks: Generic Validator and Defaulter by <a
href="https://github.com/alvaroaleman"><code>@​alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3360">kubernetes-sigs/controller-runtime#3360</a>
<ul>
<li>Existing code of the form
<code>builder.WebhookManagedBy(mgr).For(&amp;corev1.Deployment{})</code>
has to be changed to <code>builder.WebhookManagedBy(mgr,
&amp;appsv1.Deployment{})</code></li>
<li>Existing webhook implementations have to be changed to take the
concrete object rather than <code>runtime.Object</code>, for example
from <code>ValidateCreate(ctx context.Context, obj runtime.Object)
(admission.Warnings, error)</code> to <code>ValidateCreate(ctx
context.Context, obj *appsv1.Deployment) (admission.Warnings,
error)</code></li>
</ul>
</li>
</ul>
<h2>✨ Features</h2>
<ul>
<li>Cache: Allow fine-granular SyncPeriod configuration by <a
href="https://github.com/sbueringer"><code>@​sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3376">kubernetes-sigs/controller-runtime#3376</a></li>
<li>Client: Add FieldOwner option to client.Options by <a
href="https://github.com/aerfio"><code>@​aerfio</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3389">kubernetes-sigs/controller-runtime#3389</a></li>
<li>Client: Add FieldValidation option to client.Options by <a
href="https://github.com/aerfio"><code>@​aerfio</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3393">kubernetes-sigs/controller-runtime#3393</a></li>
<li>Conversion: Enable implementation of conversion outside of API
packages by <a
href="https://github.com/sbueringer"><code>@​sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3335">kubernetes-sigs/controller-runtime#3335</a></li>
<li>Metrics: Add controller_runtime_reconcile_timeouts_total metric to
track ReconciliationTimeout timeouts by <a
href="https://github.com/godwinpang"><code>@​godwinpang</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3382">kubernetes-sigs/controller-runtime#3382</a></li>
<li>Priorityqueue: Add optional Priority field to reconcile.Result by <a
href="https://github.com/sbueringer"><code>@​sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3333">kubernetes-sigs/controller-runtime#3333</a></li>
<li>Priorityqueue: Enable per default by <a
href="https://github.com/sbueringer"><code>@​sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3332">kubernetes-sigs/controller-runtime#3332</a></li>
<li>Priorityqueue: Use a buffer to optimize priority queue AddWithOpts
performance by <a
href="https://github.com/zach593"><code>@​zach593</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3415">kubernetes-sigs/controller-runtime#3415</a></li>
<li>Source/Kind: Delay reconciliation until handlers sync by <a
href="https://github.com/GonzaloLuminary"><code>@​GonzaloLuminary</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3406">kubernetes-sigs/controller-runtime#3406</a></li>
<li>Webhooks: Add WithContextFunc to WebhookBuilder by <a
href="https://github.com/dmvolod"><code>@​dmvolod</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3324">kubernetes-sigs/controller-runtime#3324</a></li>
</ul>
<h2>🐛 Bugfixes</h2>
<ul>
<li>Client: Allow SSA after normal resource creation by <a
href="https://github.com/filipcirtog"><code>@​filipcirtog</code></a> in
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3346">kubernetes-sigs/controller-runtime#3346</a></li>
<li>Client: Fix List in namespaced client to list objects that are
cluster scoped by <a
href="https://github.com/troy0820"><code>@​troy0820</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3351">kubernetes-sigs/controller-runtime#3351</a>
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3353">kubernetes-sigs/controller-runtime#3353</a></li>
<li>Envtest: Respect pre-configured binary paths in ControlPlane by <a
href="https://github.com/mzhaom"><code>@​mzhaom</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3372">kubernetes-sigs/controller-runtime#3372</a></li>
<li>Fakeclient: Fix a number of bugs when updating through apply by <a
href="https://github.com/alvaroaleman"><code>@​alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3319">kubernetes-sigs/controller-runtime#3319</a></li>
<li>FakeClient: Fix Apply with Unstructured ApplyConfiguration and
resourceVersion unset by <a
href="https://github.com/sbueringer"><code>@​sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3403">kubernetes-sigs/controller-runtime#3403</a></li>
<li>Fakeclient: Fix SSA after List with non-list kind by <a
href="https://github.com/sbueringer"><code>@​sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3364">kubernetes-sigs/controller-runtime#3364</a></li>
<li>Fakeclient: Panic when trying to build more than one instance of
fake.ClientBuilder by <a
href="https://github.com/troy0820"><code>@​troy0820</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3314">kubernetes-sigs/controller-runtime#3314</a></li>
<li>Leaderelection: Copy all parent context values to leader elector's
context by <a
href="https://github.com/msudheendra-cflt"><code>@​msudheendra-cflt</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3327">kubernetes-sigs/controller-runtime#3327</a></li>
<li>Metrics: Adding missing exponential buckets on webhook native
histogram by <a
href="https://github.com/brito-rafa"><code>@​brito-rafa</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3411">kubernetes-sigs/controller-runtime#3411</a></li>
<li>Priorityqueue: Do FIFO ordering within priorities and not across by
<a href="https://github.com/zach593"><code>@​zach593</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3408">kubernetes-sigs/controller-runtime#3408</a></li>
<li>Priorityqueue: Don't block on Get when queue is shutdown (2nd try)
by <a href="https://github.com/sbueringer"><code>@​sbueringer</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3337">kubernetes-sigs/controller-runtime#3337</a></li>
<li>Priorityqueue: Ensure priority queue always returns high-priority
items first by <a
href="https://github.com/moritzmoe"><code>@​moritzmoe</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3330">kubernetes-sigs/controller-runtime#3330</a></li>
<li>Priorityqueue: Fix
TestWhenAddingMultipleItemsWithRatelimitTrueTheyDontAffectEachOther by
<a href="https://github.com/zach593"><code>@​zach593</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3395">kubernetes-sigs/controller-runtime#3395</a></li>
<li>Priorityqueue: Limit depthWithPriorityMetric cardinality to 25 by <a
href="https://github.com/alvaroaleman"><code>@​alvaroaleman</code></a>
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3419">kubernetes-sigs/controller-runtime#3419</a></li>
<li>Priorityqueue: Properly sync the <code>waiter</code> manipulation by
<a href="https://github.com/fossedihelm"><code>@​fossedihelm</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3368">kubernetes-sigs/controller-runtime#3368</a></li>
<li>setup-envtest: Select the newest Kubernetes by default by <a
href="https://github.com/cbandy"><code>@​cbandy</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3380">kubernetes-sigs/controller-runtime#3380</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/129853d4ae0548600432fb76cd4d965cfcb854a6"><code>129853d</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3419">#3419</a>
from alvaroaleman/limit-cardinality</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/00b8b07cf3445ce3a46bd6c30430401814311392"><code>00b8b07</code></a>
:bug: Limit depthWithPriorityMetric cardinality to 25</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/43b0e35a8e53c7976038c106a5f5e953e64deffd"><code>43b0e35</code></a>
✨ Delay reconciliation until handlers sync (<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3406">#3406</a>)</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/137b9c03159a5a3314f9212159219a044a66933b"><code>137b9c0</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3415">#3415</a>
from zach593/pq-buffer</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/c47f9cb5104b0f46d98f6a2c1a424e7cc654d607"><code>c47f9cb</code></a>
Use a buffer to optimize priority queue AddWithOpts performance</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/5de4c4f5997c4b9469c7cfe003eff06bfdbd7f87"><code>5de4c4f</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3416">#3416</a>
from alvaroaleman/twotrees</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/9de69a734f9125a15d06a001320cc758aaec87e1"><code>9de69a7</code></a>
:seedling: Priorityqueue: Use separate b-trees for ready and non-ready
items</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/0c3a9102bc0af27b969b17191e68e6f28ff12c23"><code>0c3a910</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3408">#3408</a>
from zach593/pq-fifo</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/31d30b6696c75a8b6fc29a0b85b7686eefecca72"><code>31d30b6</code></a>
fix priority queue ordering when item priority changes</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/a0855902b3703e1fe66b06715d2fb0716fd1a4dd"><code>a085590</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3411">#3411</a>
from brito-rafa/issue-3410-expbucket-webhook</li>
<li>Additional commits viewable in <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.22.4...v0.23.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sigs.k8s.io/controller-runtime&package-manager=go_modules&previous-version=0.22.4&new-version=0.23.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

# PR v1.5 roadmap: Auth, ACL coverage, and proxy protocol hardening

## Summary
This PR implements the v1.5 auth groundwork: broker-side ACL enforcement
improvements, connection-level principal plumbing with PROXY protocol
support, expanded ACL test coverage, and documentation updates. It also
adds rate-limited auth denial logs and tightens proxy protocol parsing
behavior.

## Key Changes
- Added connection-scoped auth context and PROXY protocol v1/v2 parsing
for principal derivation.
- New principal sources via env: `client_id` (default), `remote_addr`,
`proxy_addr`; with fail‑closed behavior when PROXY protocol is enabled.
- Rate-limited authorization‑denied logs + metrics for visibility.
- Expanded ACL tests (admin ops + group write paths) and e2e ACL
coverage.
- Helm/operator wiring for new auth/principal envs.
- Docs updates: operations/security/protocol alignments, trust boundary
notes, proxy header limits, fail‑closed behavior.
- Ignore local `notes/` directory in `.gitignore`.

## Details
- **Broker auth plumbing**
  - Conn context + principal source selection.
- PROXY protocol parsing with v1 max header length and v2 LOCAL
handling.
- Fail‑closed when `KAFSCALE_PROXY_PROTOCOL=true` and header
missing/invalid.
- **ACL enforcement and tests**
- Unit/protocol tests for
CreateTopics/DeleteTopics/AlterConfigs/CreatePartitions/DeleteGroups.
  - Unit/protocol tests for Join/Sync/Heartbeat/Leave/OffsetCommit.
  - e2e ACL test coverage (`TestACLsE2E`).
- **Docs**
- Operations: principal source options, trust boundary, fail‑closed
behavior, header limits, LOCAL note.
  - Security: ACL posture and proxy protocol notes.
  - Protocol: SASL handshake behavior clarified.
- **Helm/Operator**
- New values + env passthrough for principal source and proxy protocol.

## Tests
- `make test`
- `make test-acl`

## Notes for Reviewers
- PROXY v1 header length is capped at 256 bytes (rejects oversized
headers).
- PROXY v2 LOCAL is accepted (no identity); ensure LB health checks
don’t require ACL-protected operations.
- ACLs with `client_id` remain spoofable unless trusted edge auth is
enforced; warnings are logged on startup.

## Summary
Fixes per‑group authorization semantics for DescribeGroups/DeleteGroups,
accepts PROXY v1 `UNKNOWN` as valid, and adds targeted tests for mixed
allow/deny and PROXY protocol parsing. Also adds a small
integration-style ACL test that uses proxy‑derived principals.

## Changes
- **Per‑group authz**: DescribeGroups/DeleteGroups now evaluate each
group independently and return mixed results instead of all‑or‑nothing.
- **PROXY v1 UNKNOWN**: Treated as valid (local/no identity) rather than
malformed.
- **Tests**:
  - Mixed allow/deny for DescribeGroups + DeleteGroups.
  - PROXY v1 UNKNOWN + PROXY v2 LOCAL parsing.
  - ACL allow via proxy‑derived principal for Produce.

## Tests
- `go test ./cmd/broker -run ACL`
- `go test ./pkg/broker -run ProxyProtocol`
- `make test-acl` (runs `KAFSCALE_E2E=1 go test -tags=e2e ./test/e2e
-run TestACLsE2E`)

## Notes
- PROXY v2 LOCAL connections are accepted with no identity; ensure LB
health checks don’t rely on ACL‑protected operations.

## Summary

chore: v1.5 release notes and bump 

## Testing

- [ ] `go test ./...`
- [ ] `make test-produce-consume` (broker changes)
- [ ] `make test-consumer-group` (group changes)

## Checklist

- [ ] Added/updated unit tests for new logic
- [ ] Added/updated e2e coverage for bug fixes
- [ ] Added license headers to new files

## Summary
- Install git in the iceberg-processor build stage so go mod download
can resolve tagged modules

## Testing
- Not run (Docker build failure in CI was due to missing git)

## Summary
- Add the missing go.sum entry for github.com/KafScale/[email protected]
used by the iceberg processor build

## Testing
- Not run (checksum update only)