Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package clusterctl for openSUSE:Factory 
checked in at 2026-11-05 18:21:15
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/clusterctl (Old)
 and      /work/SRC/openSUSE:Factory/.clusterctl.new.3759290 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "clusterctl"

Thu Nov  5 18:21:15 2026 rev:38 rq:1395124 version:1.14.4

Changes:
--------
--- /work/SRC/openSUSE:Factory/clusterctl/clusterctl.changes    2026-10-08 
11:59:47.475977716 +0200
+++ /work/SRC/openSUSE:Factory/.clusterctl.new.3759290/clusterctl.changes       
2026-11-05 18:22:51.616062831 +0100
@@ -1,0 +2,26 @@
+Wed Nov 04 10:18:55 UTC 2026 - Johannes Kastl 
<[email protected]>
+
+- Update to version 1.14.4:
+  * Bug Fixes
+    - clusterctl: Fix clusterctl listing of resources whose kind
+      ends in List (#14358)
+  * Others
+    - clusterctl: Bump cert-manager to v1.21.3 (#14440)
+    - Dependency: Bump corefile-migration to v1.0.36 (#14418)
+    - Dependency: Bump go to 1.26.10 (#14393)
+    - Security: Bump go to 1.26.9 and dependencies for security
+      (#14361)
+    - Security: Fix typo in trivy DB mirror (#14448)
+  * Dependencies changed
+    - github.com/coredns/corefile-migration: v1.0.35 → v1.0.36
+    - golang.org/x/crypto: v0.56.0 → v0.57.0
+    - golang.org/x/mod: v0.38.0 → v0.41.0
+    - golang.org/x/net: v0.58.0 → v0.60.0
+    - golang.org/x/sync: v0.22.0 → v0.23.0
+    - golang.org/x/sys: v0.47.0 → v0.48.0
+    - golang.org/x/telemetry: 49f421f → a038080
+    - golang.org/x/term: v0.45.0 → v0.46.0
+    - golang.org/x/text: v0.41.0 → v0.42.0
+    - golang.org/x/tools: v0.48.0 → v0.49.0
+
+-------------------------------------------------------------------

Old:
----
  clusterctl-1.14.3.obscpio

New:
----
  clusterctl-1.14.4.obscpio

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ clusterctl.spec ++++++
--- /var/tmp/diff_new_pack.yXNsbZ/_old  2026-11-05 18:22:54.241172216 +0100
+++ /var/tmp/diff_new_pack.yXNsbZ/_new  2026-11-05 18:22:54.244172341 +0100
@@ -20,7 +20,7 @@
 %define version_git_minor %(echo %{version} | awk 'BEGIN { FS=\".\"}; {print 
$2}')
 
 Name:           clusterctl
-Version:        1.14.3
+Version:        1.14.4
 Release:        0
 Summary:        CLI tool to handle the lifecycle of a Cluster API management 
cluster
 License:        Apache-2.0
@@ -29,8 +29,8 @@
 Source1:        vendor.tar.gz
 BuildRequires:  bash-completion
 BuildRequires:  fish
+BuildRequires:  go1.26 >= 1.26.10
 BuildRequires:  zsh
-BuildRequires:  golang(API) >= 1.26
 
 %description
 The clusterctl CLI tool handles the lifecycle of a Cluster API management

++++++ _service ++++++
--- /var/tmp/diff_new_pack.yXNsbZ/_old  2026-11-05 18:22:54.334176091 +0100
+++ /var/tmp/diff_new_pack.yXNsbZ/_new  2026-11-05 18:22:54.342176425 +0100
@@ -3,7 +3,7 @@
     <param 
name="url">https://github.com/kubernetes-sigs/cluster-api.git</param>
     <param name="scm">git</param>
     <param name="exclude">.git</param>
-    <param name="revision">refs/tags/v1.14.3</param>
+    <param name="revision">refs/tags/v1.14.4</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="versionrewrite-pattern">v(.*)</param>
     <param name="changesgenerate">enable</param>

++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.yXNsbZ/_old  2026-11-05 18:22:54.393178550 +0100
+++ /var/tmp/diff_new_pack.yXNsbZ/_new  2026-11-05 18:22:54.404179008 +0100
@@ -3,6 +3,6 @@
                 <param 
name="url">https://github.com/kubernetes-sigs/cluster-api</param>
               <param 
name="changesrevision">cf0f6c00fbf7d5c5dbf37bd09554c6389de93861</param></service><service
 name="tar_scm">
                 <param 
name="url">https://github.com/kubernetes-sigs/cluster-api.git</param>
-              <param 
name="changesrevision">825a79dc92ddcca6acc935e233201c697a2f7488</param></service></servicedata>
+              <param 
name="changesrevision">4356c154f4a76b8939748ef7ebc2d0793ffe47e8</param></service></servicedata>
 (No newline at EOF)
 

++++++ clusterctl-1.14.3.obscpio -> clusterctl-1.14.4.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/Makefile 
new/clusterctl-1.14.4/Makefile
--- old/clusterctl-1.14.3/Makefile      2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/Makefile      2026-11-03 09:29:50.000000000 +0100
@@ -23,7 +23,7 @@
 #
 # Go.
 #
-GO_VERSION ?= 1.26.6
+GO_VERSION ?= 1.26.10
 GO_DIRECTIVE_VERSION ?= 1.26.0
 GO_CONTAINER_IMAGE ?= docker.io/library/golang:$(GO_VERSION)
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/Tiltfile 
new/clusterctl-1.14.4/Tiltfile
--- old/clusterctl-1.14.3/Tiltfile      2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/Tiltfile      2026-11-03 09:29:50.000000000 +0100
@@ -173,7 +173,7 @@
 
 tilt_helper_dockerfile_header = """
 # Tilt image
-FROM golang:1.26.6 as tilt-helper
+FROM golang:1.26.10 as tilt-helper
 # Install delve. Note this should be kept in step with the Go release minor 
version.
 RUN go install github.com/go-delve/delve/cmd/[email protected]
 # Support live reloading with Tilt
@@ -184,7 +184,7 @@
 """
 
 tilt_dockerfile_header = """
-FROM golang:1.26.6 as tilt
+FROM golang:1.26.10 as tilt
 WORKDIR /
 COPY --from=tilt-helper /process.txt .
 COPY --from=tilt-helper /start.sh .
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/api/go.mod 
new/clusterctl-1.14.4/api/go.mod
--- old/clusterctl-1.14.3/api/go.mod    2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/api/go.mod    2026-11-03 09:29:50.000000000 +0100
@@ -17,8 +17,8 @@
        github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // 
indirect
        github.com/x448/float16 v0.8.4 // indirect
        go.yaml.in/yaml/v2 v2.4.3 // indirect
-       golang.org/x/net v0.49.0 // indirect
-       golang.org/x/text v0.40.0 // indirect
+       golang.org/x/net v0.60.0 // indirect
+       golang.org/x/text v0.42.0 // indirect
        gopkg.in/inf.v0 v0.9.1 // indirect
        k8s.io/klog/v2 v2.140.0 // indirect
        k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/api/go.sum 
new/clusterctl-1.14.4/api/go.sum
--- old/clusterctl-1.14.3/api/go.sum    2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/api/go.sum    2026-11-03 09:29:50.000000000 +0100
@@ -36,10 +36,10 @@
 github.com/x448/float16 v0.8.4/go.mod 
h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod 
h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod 
h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod 
h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod 
h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c 
h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod 
h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/cmd/clusterctl/client/cluster/proxy.go 
new/clusterctl-1.14.4/cmd/clusterctl/client/cluster/proxy.go
--- old/clusterctl-1.14.3/cmd/clusterctl/client/cluster/proxy.go        
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/cmd/clusterctl/client/cluster/proxy.go        
2026-11-03 09:29:50.000000000 +0100
@@ -352,13 +352,13 @@
 func listObjByGVK(ctx context.Context, c client.Client, groupVersion, kind 
string, options []client.ListOption) (*unstructured.UnstructuredList, error) {
        objList := new(unstructured.UnstructuredList)
        objList.SetAPIVersion(groupVersion)
-       objList.SetKind(kind)
+       objList.SetKind(kind + "List")
 
        resourceListBackoff := newReadBackoff()
        if err := retryWithExponentialBackoff(ctx, resourceListBackoff, 
func(ctx context.Context) error {
                return c.List(ctx, objList, options...)
        }); err != nil {
-               return nil, pkgerrors.Wrapf(err, "failed to list objects for 
the %q GroupVersionKind", objList.GroupVersionKind())
+               return nil, pkgerrors.Wrapf(err, "failed to list objects for 
the %q GroupVersionKind", schema.FromAPIVersionAndKind(groupVersion, kind))
        }
 
        return objList, nil
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/cmd/clusterctl/client/cluster/proxy_test.go 
new/clusterctl-1.14.4/cmd/clusterctl/client/cluster/proxy_test.go
--- old/clusterctl-1.14.3/cmd/clusterctl/client/cluster/proxy_test.go   
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/cmd/clusterctl/client/cluster/proxy_test.go   
2026-11-03 09:29:50.000000000 +0100
@@ -17,6 +17,7 @@
 package cluster
 
 import (
+       "context"
        "fmt"
        "os"
        "path/filepath"
@@ -24,7 +25,10 @@
        "time"
 
        . "github.com/onsi/gomega"
+       "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
        "k8s.io/client-go/rest"
+       "sigs.k8s.io/controller-runtime/pkg/client"
+       "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
        "sigs.k8s.io/cluster-api/cmd/clusterctl/internal/test"
        "sigs.k8s.io/cluster-api/version"
@@ -260,6 +264,98 @@
                })
        }
 }
+
+func TestListObjByGVK(t *testing.T) {
+       tests := []struct {
+               name          string
+               groupVersion  string
+               kind          string
+               objs          []client.Object
+               expectedNames []string
+       }{
+               {
+                       name:         "return objects of a kind ending in List",
+                       groupVersion: "ec2.aws.m.upbound.io/v1beta1",
+                       kind:         "ManagedPrefixList",
+                       objs: []client.Object{
+                               &unstructured.Unstructured{
+                                       Object: map[string]interface{}{
+                                               "apiVersion": 
"ec2.aws.m.upbound.io/v1beta1",
+                                               "kind":       
"ManagedPrefixList",
+                                               "metadata": 
map[string]interface{}{
+                                                       "name":      "labelled",
+                                                       "namespace": "ns1",
+                                                       "labels":    
map[string]interface{}{"cluster.x-k8s.io/provider": "infrastructure-foo"},
+                                               },
+                                       },
+                               },
+                               &unstructured.Unstructured{
+                                       Object: map[string]interface{}{
+                                               "apiVersion": 
"ec2.aws.m.upbound.io/v1beta1",
+                                               "kind":       
"ManagedPrefixList",
+                                               "metadata": 
map[string]interface{}{
+                                                       "name":      
"not-labelled",
+                                                       "namespace": "ns1",
+                                               },
+                                       },
+                               },
+                       },
+                       expectedNames: []string{"labelled"},
+               },
+               {
+                       name:          "return no objects of a kind ending in 
List",
+                       groupVersion:  "ec2.aws.m.upbound.io/v1beta1",
+                       kind:          "ManagedPrefixList",
+                       expectedNames: []string{},
+               },
+               {
+                       name:         "return objects of a kind not ending in 
List",
+                       groupVersion: "v1",
+                       kind:         "ConfigMap",
+                       objs: []client.Object{
+                               &unstructured.Unstructured{
+                                       Object: map[string]interface{}{
+                                               "apiVersion": "v1",
+                                               "kind":       "ConfigMap",
+                                               "metadata": 
map[string]interface{}{
+                                                       "name":      "labelled",
+                                                       "namespace": "ns1",
+                                                       "labels":    
map[string]interface{}{"cluster.x-k8s.io/provider": "infrastructure-foo"},
+                                               },
+                                       },
+                               },
+                               &unstructured.Unstructured{
+                                       Object: map[string]interface{}{
+                                               "apiVersion": "v1",
+                                               "kind":       "ConfigMap",
+                                               "metadata": 
map[string]interface{}{
+                                                       "name":      
"not-labelled",
+                                                       "namespace": "ns1",
+                                               },
+                                       },
+                               },
+                       },
+                       expectedNames: []string{"labelled"},
+               },
+       }
+       for _, tt := range tests {
+               t.Run(tt.name, func(t *testing.T) {
+                       g := NewWithT(t)
+
+                       c := 
fake.NewClientBuilder().WithObjects(tt.objs...).Build()
+
+                       objList, err := listObjByGVK(context.Background(), c, 
tt.groupVersion, tt.kind, 
[]client.ListOption{client.MatchingLabels{"cluster.x-k8s.io/provider": 
"infrastructure-foo"}})
+                       g.Expect(err).ToNot(HaveOccurred())
+
+                       names := []string{}
+                       for _, obj := range objList.Items {
+                               g.Expect(obj.GetKind()).To(Equal(tt.kind))
+                               names = append(names, obj.GetName())
+                       }
+                       g.Expect(names).To(ConsistOf(tt.expectedNames))
+               })
+       }
+}
 
 func kubeconfig(currentContext, namespace string) string {
        return fmt.Sprintf(`---
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/cmd/clusterctl/client/config/cert_manager_client.go 
new/clusterctl-1.14.4/cmd/clusterctl/client/config/cert_manager_client.go
--- old/clusterctl-1.14.3/cmd/clusterctl/client/config/cert_manager_client.go   
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/cmd/clusterctl/client/config/cert_manager_client.go   
2026-11-03 09:29:50.000000000 +0100
@@ -30,7 +30,7 @@
        CertManagerConfigKey = "cert-manager"
 
        // CertManagerDefaultVersion defines the default cert-manager version 
to be used by clusterctl.
-       CertManagerDefaultVersion = "v1.21.2"
+       CertManagerDefaultVersion = "v1.21.3"
 
        // CertManagerDefaultURL defines the default cert-manager repository 
url to be used by clusterctl.
        // NOTE: At runtime CertManagerDefaultVersion may be replaced with the
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/controllers/clustercache/cluster_accessor_client.go 
new/clusterctl-1.14.4/controllers/clustercache/cluster_accessor_client.go
--- old/clusterctl-1.14.3/controllers/clustercache/cluster_accessor_client.go   
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/controllers/clustercache/cluster_accessor_client.go   
2026-11-03 09:29:50.000000000 +0100
@@ -141,6 +141,20 @@
        if restConfig.AuthProvider != nil {
                return nil, pkgerrors.New("AuthProvider is not supported in 
ClusterCache")
        }
+       // Note: File-based credentials are not supported, as file paths would 
be resolved against the
+       // controller's own filesystem. The kubeconfig Secret must contain all 
credential data inline.
+       if restConfig.BearerTokenFile != "" {
+               return nil, pkgerrors.New("BearerTokenFile is not supported in 
ClusterCache")
+       }
+       if restConfig.CertFile != "" {
+               return nil, pkgerrors.New("TLSClientConfig.CertFile is not 
supported in ClusterCache")
+       }
+       if restConfig.KeyFile != "" {
+               return nil, pkgerrors.New("TLSClientConfig.KeyFile is not 
supported in ClusterCache")
+       }
+       if restConfig.CAFile != "" {
+               return nil, pkgerrors.New("TLSClientConfig.CAFile is not 
supported in ClusterCache")
+       }
 
        restConfig.UserAgent = clientConfig.UserAgent
        restConfig.Timeout = clientConfig.Timeout
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/controllers/clustercache/cluster_accessor_client_test.go 
new/clusterctl-1.14.4/controllers/clustercache/cluster_accessor_client_test.go
--- 
old/clusterctl-1.14.3/controllers/clustercache/cluster_accessor_client_test.go  
    2026-10-06 16:40:37.000000000 +0200
+++ 
new/clusterctl-1.14.4/controllers/clustercache/cluster_accessor_client_test.go  
    2026-11-03 09:29:50.000000000 +0100
@@ -17,6 +17,9 @@
 package clustercache
 
 import (
+       "fmt"
+       "os"
+       "path/filepath"
        "testing"
 
        . "github.com/onsi/gomega"
@@ -25,6 +28,8 @@
        "k8s.io/apimachinery/pkg/types"
        "sigs.k8s.io/controller-runtime/pkg/client"
        "sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+       "sigs.k8s.io/cluster-api/util/secret"
 )
 
 func TestRunningOnWorkloadCluster(t *testing.T) {
@@ -144,3 +149,95 @@
                })
        }
 }
+
+func TestCreateRESTConfig(t *testing.T) {
+       const (
+               namespace   = "default"
+               clusterName = "test-cluster"
+       )
+
+       kubeconfig := func(clusterFields, userFields string) string {
+               return fmt.Sprintf(`apiVersion: v1
+kind: Config
+clusters:
+- name: c
+  cluster:
+    server: https://test-cluster.example.com:6443
+%s
+contexts:
+- name: c
+  context:
+    cluster: c
+    user: u
+current-context: c
+users:
+- name: u
+  user:
+%s
+`, clusterFields, userFields)
+       }
+
+       // client-go verifies that referenced files exist when parsing the 
kubeconfig.
+       dir := t.TempDir()
+       filePath := filepath.Join(dir, "file")
+       if err := os.WriteFile(filePath, []byte("data"), 0o600); err != nil {
+               t.Fatal(err)
+       }
+
+       tests := []struct {
+               name       string
+               kubeconfig string
+               wantErr    string
+       }{
+               {
+                       name:       "inline credentials are accepted",
+                       kubeconfig: kubeconfig("    insecure-skip-tls-verify: 
true", "    token: token"),
+               },
+               {
+                       name:       "tokenFile is rejected",
+                       kubeconfig: kubeconfig("    insecure-skip-tls-verify: 
true", "    tokenFile: "+filePath),
+                       wantErr:    "BearerTokenFile is not supported in 
ClusterCache",
+               },
+               {
+                       name:       "client-certificate file is rejected",
+                       kubeconfig: kubeconfig("    insecure-skip-tls-verify: 
true", "    client-certificate: "+filePath+"\n    client-key: "+filePath),
+                       wantErr:    "TLSClientConfig.CertFile is not supported 
in ClusterCache",
+               },
+               {
+                       name:       "client-key file is rejected",
+                       kubeconfig: kubeconfig("    insecure-skip-tls-verify: 
true", "    client-certificate-data: ZGF0YQ==\n    client-key: "+filePath),
+                       wantErr:    "TLSClientConfig.KeyFile is not supported 
in ClusterCache",
+               },
+               {
+                       name:       "certificate-authority file is rejected",
+                       kubeconfig: kubeconfig("    certificate-authority: 
"+filePath, "    token: token"),
+                       wantErr:    "TLSClientConfig.CAFile is not supported in 
ClusterCache",
+               },
+       }
+
+       for _, tt := range tests {
+               t.Run(tt.name, func(t *testing.T) {
+                       g := NewWithT(t)
+
+                       kubeconfigSecret := &corev1.Secret{
+                               ObjectMeta: metav1.ObjectMeta{
+                                       Name:      secret.Name(clusterName, 
secret.Kubeconfig),
+                                       Namespace: namespace,
+                               },
+                               Data: map[string][]byte{
+                                       secret.KubeconfigDataName: 
[]byte(tt.kubeconfig),
+                               },
+                       }
+                       c := 
fake.NewClientBuilder().WithObjects(kubeconfigSecret).Build()
+
+                       restConfig, err := createRESTConfig(ctx, 
&clusterAccessorClientConfig{}, c, client.ObjectKey{Namespace: namespace, Name: 
clusterName})
+                       if tt.wantErr != "" {
+                               
g.Expect(err).To(MatchError(ContainSubstring(tt.wantErr)))
+                               g.Expect(restConfig).To(BeNil())
+                               return
+                       }
+                       g.Expect(err).ToNot(HaveOccurred())
+                       g.Expect(restConfig).ToNot(BeNil())
+               })
+       }
+}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/controlplane/kubeadm/pkg/filters.go 
new/clusterctl-1.14.4/controlplane/kubeadm/pkg/filters.go
--- old/clusterctl-1.14.3/controlplane/kubeadm/pkg/filters.go   2026-10-06 
16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/controlplane/kubeadm/pkg/filters.go   2026-11-03 
09:29:50.000000000 +0100
@@ -19,6 +19,7 @@
 import (
        "context"
        "fmt"
+       "slices"
 
        pkgerrors "github.com/pkg/errors"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -310,7 +311,7 @@
                // Convert InitConfiguration to JoinConfiguration
                currentKubeadmConfig.Spec.JoinConfiguration.Timeouts = 
currentKubeadmConfig.Spec.InitConfiguration.Timeouts
                currentKubeadmConfig.Spec.JoinConfiguration.Patches = 
currentKubeadmConfig.Spec.InitConfiguration.Patches
-               currentKubeadmConfig.Spec.JoinConfiguration.SkipPhases = 
currentKubeadmConfig.Spec.InitConfiguration.SkipPhases
+               currentKubeadmConfig.Spec.JoinConfiguration.SkipPhases = 
removeKubeadmInitOnlyPhases(currentKubeadmConfig.Spec.InitConfiguration.SkipPhases)
                currentKubeadmConfig.Spec.JoinConfiguration.NodeRegistration = 
currentKubeadmConfig.Spec.InitConfiguration.NodeRegistration
                currentKubeadmConfig.Spec.JoinConfiguration.ControlPlane = 
&bootstrapv1.JoinControlPlane{
                        LocalAPIEndpoint: 
currentKubeadmConfig.Spec.InitConfiguration.LocalAPIEndpoint,
@@ -374,6 +375,14 @@
        return desiredKubeadmConfig, currentKubeadmConfig
 }
 
+// removeKubeadmInitOnlyPhases removes phases that are only supported by 
kubeadm init
+// and accordingly cannot be set in a JoinConfiguration.
+func removeKubeadmInitOnlyPhases(phases []string) []string {
+       return slices.DeleteFunc(phases, func(p string) bool {
+               return p == "addon/coredns" || p == "addon/kube-proxy"
+       })
+}
+
 // dropOmittableFields makes the comparison tolerant to omittable fields being 
set in the go struct. It applies to:
 // - empty array vs nil
 // - empty map vs nil
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/controlplane/kubeadm/pkg/filters_test.go 
new/clusterctl-1.14.4/controlplane/kubeadm/pkg/filters_test.go
--- old/clusterctl-1.14.3/controlplane/kubeadm/pkg/filters_test.go      
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/controlplane/kubeadm/pkg/filters_test.go      
2026-11-03 09:29:50.000000000 +0100
@@ -37,6 +37,7 @@
        kubeadmtypes "sigs.k8s.io/cluster-api/bootstrap/kubeadm/pkg/types"
        "sigs.k8s.io/cluster-api/bootstrap/kubeadm/pkg/types/upstream"
        "sigs.k8s.io/cluster-api/controlplane/kubeadm/pkg/desiredstate"
+       "sigs.k8s.io/cluster-api/internal/util/compare"
        "sigs.k8s.io/cluster-api/util/test/builder"
 )
 
@@ -433,6 +434,7 @@
                                KubeadmConfigSpec: 
bootstrapv1.KubeadmConfigSpec{
                                        ClusterConfiguration: 
bootstrapv1.ClusterConfiguration{},
                                        InitConfiguration: 
bootstrapv1.InitConfiguration{
+                                               SkipPhases: 
[]string{"addon/coredns", "addon/kube-proxy"},
                                                NodeRegistration: 
bootstrapv1.NodeRegistrationOptions{
                                                        Name: "name",
                                                },
@@ -469,6 +471,7 @@
                                },
                                Spec: bootstrapv1.KubeadmConfigSpec{
                                        InitConfiguration: 
bootstrapv1.InitConfiguration{
+                                               SkipPhases: 
[]string{"addon/coredns", "addon/kube-proxy"},
                                                NodeRegistration: 
bootstrapv1.NodeRegistrationOptions{
                                                        Name: "name",
                                                },
@@ -484,6 +487,106 @@
                g.Expect(match).To(BeTrue())
                g.Expect(reason).To(BeEmpty())
        })
+       t.Run("returns false if JoinConfiguration is not equal: skipPhases is 
the same in the returned KubeadmConfigs", func(t *testing.T) {
+               g := NewWithT(t)
+               kcp := &controlplanev1.KubeadmControlPlane{
+                       Spec: controlplanev1.KubeadmControlPlaneSpec{
+                               KubeadmConfigSpec: 
bootstrapv1.KubeadmConfigSpec{
+                                       ClusterConfiguration: 
bootstrapv1.ClusterConfiguration{},
+                                       InitConfiguration: 
bootstrapv1.InitConfiguration{
+                                               Patches: bootstrapv1.Patches{
+                                                       Directory: 
"/test/patches", // This field has changed
+                                               },
+                                               SkipPhases: 
[]string{"addon/coredns", "addon/kube-proxy"},
+                                       },
+                                       JoinConfiguration: 
bootstrapv1.JoinConfiguration{
+                                               Patches: bootstrapv1.Patches{
+                                                       Directory: 
"/test/patches", // This field has changed
+                                               },
+                                               // SkipPhases: is not set to 
[]string{"addon/coredns", "addon/kube-proxy"} here, but this
+                                               // field should be the same for 
both returned KubeadmConfigs so in-place updates
+                                               // don't have to account for 
this diff.
+                                       },
+                               },
+                               Version: "v1.30.0",
+                       },
+               }
+               m := &clusterv1.Machine{
+                       ObjectMeta: metav1.ObjectMeta{
+                               Namespace: "default",
+                               Name:      "test",
+                       },
+                       Spec: clusterv1.MachineSpec{
+                               Bootstrap: clusterv1.Bootstrap{
+                                       ConfigRef: 
clusterv1.ContractVersionedObjectReference{
+                                               Kind:     "KubeadmConfig",
+                                               Name:     "test",
+                                               APIGroup: 
bootstrapv1.GroupVersion.Group,
+                                       },
+                               },
+                       },
+               }
+               machineConfigs := map[string]*bootstrapv1.KubeadmConfig{
+                       m.Name: {
+                               ObjectMeta: metav1.ObjectMeta{
+                                       Namespace: "default",
+                                       Name:      "test",
+                               },
+                               Spec: bootstrapv1.KubeadmConfigSpec{
+                                       InitConfiguration: 
bootstrapv1.InitConfiguration{
+                                               Patches: bootstrapv1.Patches{
+                                                       Directory: 
"/test/patches/old", // This field has changed
+                                               },
+                                               SkipPhases: 
[]string{"addon/coredns", "addon/kube-proxy"},
+                                       },
+                               },
+                       },
+               }
+               reason, currentKubeadmConfig, desiredKubeadmConfig, match, err 
:= matchesKubeadmConfig(machineConfigs, kcp, &clusterv1.Cluster{}, m)
+               g.Expect(err).ToNot(HaveOccurred())
+               g.Expect(currentKubeadmConfig).ToNot(BeNil())
+               g.Expect(desiredKubeadmConfig).ToNot(BeNil())
+               
g.Expect(isKubeadmConfigForJoin(desiredKubeadmConfig)).To(BeTrue())
+               g.Expect(match).To(BeFalse())
+               // Diff should show diff between InitConfigurations (skipPhases 
is the same in this case).
+               g.Expect(reason).To(BeComparableTo(`Machine KubeadmConfig is 
outdated: diff: &v1beta2.KubeadmConfigSpec{
+    ClusterConfiguration: {},
+    InitConfiguration: v1beta2.InitConfiguration{
+      ... // 2 identical fields
+      LocalAPIEndpoint: {},
+      SkipPhases:       {"addon/coredns", "addon/kube-proxy"},
+-     Patches:          v1beta2.Patches{Directory: "/test/patches/old"},
++     Patches:          v1beta2.Patches{Directory: "/test/patches"},
+      Timeouts:         {},
+    },
+    JoinConfiguration: {NodeRegistration: {ImagePullPolicy: "IfNotPresent"}},
+    Files:             nil,
+    ... // 10 identical fields
+  }`))
+               // Verify what is sent in CanUpdateMachine.
+               desiredKubeadmConfigWithJoinForDiff, 
currentKubeadmConfigWithJoinForDiff := 
PrepareKubeadmConfigsForDiff(desiredKubeadmConfig, currentKubeadmConfig, true)
+               match, diff, err := 
compare.Diff(&currentKubeadmConfigWithJoinForDiff.Spec, 
&desiredKubeadmConfigWithJoinForDiff.Spec)
+               g.Expect(err).ToNot(HaveOccurred())
+               g.Expect(match).To(BeFalse())
+               // Diff should show diff between JoinConfiguration and 
InitConfiguration converted to JoinConfiguration.
+               // The conversion to JoinConfiguration should omit phases that 
cannot be set in JoinConfiguration because
+               // they are not supported for kubeadm join.
+               g.Expect(diff).To(BeComparableTo(`&v1beta2.KubeadmConfigSpec{
+    ClusterConfiguration: {},
+    InitConfiguration:    {NodeRegistration: {ImagePullPolicy: 
"IfNotPresent"}},
+    JoinConfiguration: v1beta2.JoinConfiguration{
+      ... // 3 identical fields
+      ControlPlane: &{},
+      SkipPhases:   nil,
+-     Patches:      v1beta2.Patches{Directory: "/test/patches/old"},
++     Patches:      v1beta2.Patches{Directory: "/test/patches"},
+      Timeouts:     {},
+    },
+    Files:     nil,
+    DiskSetup: {},
+    ... // 9 identical fields
+  }`))
+       })
        t.Run("returns false if InitConfiguration is NOT equal", func(t 
*testing.T) {
                g := NewWithT(t)
                kcp := &controlplanev1.KubeadmControlPlane{
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/core/reconcilers/cluster/cluster_controller.go 
new/clusterctl-1.14.4/core/reconcilers/cluster/cluster_controller.go
--- old/clusterctl-1.14.3/core/reconcilers/cluster/cluster_controller.go        
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/core/reconcilers/cluster/cluster_controller.go        
2026-11-03 09:29:50.000000000 +0100
@@ -193,7 +193,6 @@
        }()
 
        alwaysReconcile := []clusterReconcileFunc{
-               r.reconcileCluster,
                r.reconcileInfrastructure,
                r.reconcileControlPlane,
                r.getDescendants,
@@ -209,6 +208,8 @@
                return doReconcile(ctx, reconcileDelete, s)
        }
 
+       r.reconcileCluster(ctx, s)
+
        // Handle normal reconciliation loop.
        if cluster.Spec.Topology.IsDefined() {
                if !cluster.Spec.ControlPlaneRef.IsDefined() || 
!cluster.Spec.InfrastructureRef.IsDefined() {
@@ -327,15 +328,13 @@
        deletingMessage string
 }
 
-func (r *Reconciler) reconcileCluster(_ context.Context, s *scope) 
(ctrl.Result, error) {
+func (r *Reconciler) reconcileCluster(_ context.Context, s *scope) {
        cluster := s.cluster
 
        if cluster.Labels == nil {
                cluster.Labels = make(map[string]string)
        }
        cluster.Labels[clusterv1.ClusterNameLabel] = cluster.Name
-
-       return ctrl.Result{}, nil
 }
 
 // reconcileDelete handles cluster deletion.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/core/reconcilers/cluster/cluster_controller_status.go 
new/clusterctl-1.14.4/core/reconcilers/cluster/cluster_controller_status.go
--- old/clusterctl-1.14.3/core/reconcilers/cluster/cluster_controller_status.go 
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/core/reconcilers/cluster/cluster_controller_status.go 
2026-11-03 09:29:50.000000000 +0100
@@ -78,7 +78,7 @@
        setRemoteConnectionProbeCondition(ctx, s.cluster, healthCheckingState, 
r.RemoteConnectionGracePeriod)
        setInfrastructureReadyCondition(ctx, s.cluster, s.infraCluster, 
s.infraClusterIsNotFound)
        setControlPlaneAvailableCondition(ctx, s.cluster, s.controlPlane, 
s.controlPlaneIsNotFound)
-       setControlPlaneInitializedCondition(ctx, s.cluster, s.controlPlane, 
controlPlaneContractVersion, s.descendants.controlPlaneMachines, 
s.infraClusterIsNotFound, s.getDescendantsSucceeded)
+       setControlPlaneInitializedCondition(ctx, s.cluster, s.controlPlane, 
controlPlaneContractVersion, s.descendants.controlPlaneMachines, 
s.controlPlaneIsNotFound, s.getDescendantsSucceeded)
        setWorkersAvailableCondition(ctx, s.cluster, 
clusterv1.MachinePoolList{}, s.descendants.machineDeployments, 
s.getDescendantsSucceeded)
        setControlPlaneMachinesReadyCondition(ctx, s.cluster, 
controlPlaneMachines, s.getDescendantsSucceeded)
        setWorkerMachinesReadyCondition(ctx, s.cluster, workerMachines, 
s.getDescendantsSucceeded)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/core/reconcilers/cluster/cluster_controller_test.go 
new/clusterctl-1.14.4/core/reconcilers/cluster/cluster_controller_test.go
--- old/clusterctl-1.14.3/core/reconcilers/cluster/cluster_controller_test.go   
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/core/reconcilers/cluster/cluster_controller_test.go   
2026-11-03 09:29:50.000000000 +0100
@@ -90,6 +90,16 @@
                        return len(instance.Finalizers) > 0
                }, timeout).Should(BeTrue())
 
+               // Validate the ControlPlaneInitialized condition reports the 
missing control plane.
+               g.Eventually(func(g Gomega) {
+                       g.Expect(env.Get(ctx, key, instance)).To(Succeed())
+
+                       condition := conditions.Get(instance, 
clusterv1.ClusterControlPlaneInitializedCondition)
+                       g.Expect(condition).ToNot(BeNil())
+                       
g.Expect(condition.Status).To(Equal(metav1.ConditionUnknown))
+                       
g.Expect(condition.Reason).To(Equal(clusterv1.ClusterControlPlaneDoesNotExistReason))
+               }, timeout).Should(Succeed())
+
                // Validate the RemoteConnectionProbe condition is false 
(because kubeconfig Secret doesn't exist)
                g.Eventually(func(g Gomega) {
                        g.Expect(env.Get(ctx, key, instance)).To(Succeed())
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/core/reconcilers/machine/machine_controller_status.go 
new/clusterctl-1.14.4/core/reconcilers/machine/machine_controller_status.go
--- old/clusterctl-1.14.3/core/reconcilers/machine/machine_controller_status.go 
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/core/reconcilers/machine/machine_controller_status.go 
2026-11-03 09:29:50.000000000 +0100
@@ -729,7 +729,7 @@
                return
        }
 
-       if m.Status.NodeInfo != nil && m.Status.NodeInfo.KubeletVersion != "" 
&& m.Status.NodeInfo.KubeletVersion != m.Spec.Version {
+       if m.Spec.Version != "" && m.Status.NodeInfo != nil && 
m.Status.NodeInfo.KubeletVersion != "" && m.Status.NodeInfo.KubeletVersion != 
m.Spec.Version {
                conditions.Set(m, metav1.Condition{
                        Type:   clusterv1.MachineUpToDateCondition,
                        Status: metav1.ConditionFalse,
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/core/reconcilers/machine/machine_controller_status_test.go
 
new/clusterctl-1.14.4/core/reconcilers/machine/machine_controller_status_test.go
--- 
old/clusterctl-1.14.3/core/reconcilers/machine/machine_controller_status_test.go
    2026-10-06 16:40:37.000000000 +0200
+++ 
new/clusterctl-1.14.4/core/reconcilers/machine/machine_controller_status_test.go
    2026-11-03 09:29:50.000000000 +0100
@@ -1657,6 +1657,23 @@
                        },
                },
                {
+                       name:              "up-to-date, spec.version not set",
+                       machineDeployment: &clusterv1.MachineDeployment{},
+                       machineSet:        &clusterv1.MachineSet{},
+                       machine: &clusterv1.Machine{
+                               Status: clusterv1.MachineStatus{
+                                       NodeInfo: &corev1.NodeSystemInfo{
+                                               KubeletVersion: "v1.31.0",
+                                       },
+                               },
+                       },
+                       expectCondition: &metav1.Condition{
+                               Type:   clusterv1.MachineUpToDateCondition,
+                               Status: metav1.ConditionTrue,
+                               Reason: clusterv1.MachineUpToDateReason,
+                       },
+               },
+               {
                        name: "updating (message from Updating)",
                        machineDeployment: &clusterv1.MachineDeployment{
                                Spec: clusterv1.MachineDeploymentSpec{
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/docs/book/src/clusterctl/commands/init.md 
new/clusterctl-1.14.4/docs/book/src/clusterctl/commands/init.md
--- old/clusterctl-1.14.3/docs/book/src/clusterctl/commands/init.md     
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/docs/book/src/clusterctl/commands/init.md     
2026-11-03 09:29:50.000000000 +0100
@@ -194,7 +194,7 @@
 Cluster API providers require a cert-manager version supporting the 
`cert-manager.io/v1` API to be installed in the cluster.
 
 While doing init, clusterctl checks if there is a version of cert-manager 
already installed. If not, clusterctl will
-install a default version (currently cert-manager v1.21.2). See [clusterctl 
configuration](../configuration.md) for
+install a default version (currently cert-manager v1.21.3). See [clusterctl 
configuration](../configuration.md) for
 available options to customize this operation.
 
 <aside class="note warning">
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/docs/book/src/developer/getting-started.md 
new/clusterctl-1.14.4/docs/book/src/developer/getting-started.md
--- old/clusterctl-1.14.3/docs/book/src/developer/getting-started.md    
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/docs/book/src/developer/getting-started.md    
2026-11-03 09:29:50.000000000 +0100
@@ -80,7 +80,7 @@
 You'll need to deploy [cert-manager] components on your [management 
cluster][mcluster], using `kubectl`
 
 ```bash
-kubectl apply -f 
https://github.com/cert-manager/cert-manager/releases/download/v1.21.2/cert-manager.yaml
+kubectl apply -f 
https://github.com/cert-manager/cert-manager/releases/download/v1.21.3/cert-manager.yaml
 ```
 
 Ensure the cert-manager webhook service is ready before creating the Cluster 
API components.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/go.mod new/clusterctl-1.14.4/go.mod
--- old/clusterctl-1.14.3/go.mod        2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/go.mod        2026-11-03 09:29:50.000000000 +0100
@@ -9,7 +9,7 @@
        github.com/Masterminds/sprig/v3 v3.3.0
        github.com/adrg/xdg v0.5.3
        github.com/blang/semver/v4 v4.0.0
-       github.com/coredns/corefile-migration v1.0.35
+       github.com/coredns/corefile-migration v1.0.36
        github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
        github.com/distribution/reference v0.6.0
        github.com/drone/envsubst/v2 v2.0.0-20210730161058-179042472c46
@@ -41,7 +41,7 @@
        go.uber.org/zap v1.28.0
        golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
        golang.org/x/oauth2 v0.36.0
-       golang.org/x/text v0.41.0
+       golang.org/x/text v0.42.0
        gomodules.xyz/jsonpatch/v2 v2.5.0
        google.golang.org/grpc v1.83.2
        k8s.io/api v0.36.3
@@ -143,14 +143,14 @@
        go.yaml.in/yaml/v2 v2.4.3 // indirect
        go.yaml.in/yaml/v3 v3.0.4 // indirect
        go4.org v0.0.0-20201209231011-d4a079459e60 // indirect
-       golang.org/x/crypto v0.56.0 // indirect
-       golang.org/x/mod v0.38.0 // indirect
-       golang.org/x/net v0.58.0 // indirect
-       golang.org/x/sync v0.22.0 // indirect
-       golang.org/x/sys v0.47.0 // indirect
-       golang.org/x/term v0.45.0 // indirect
+       golang.org/x/crypto v0.57.0 // indirect
+       golang.org/x/mod v0.41.0 // indirect
+       golang.org/x/net v0.60.0 // indirect
+       golang.org/x/sync v0.23.0 // indirect
+       golang.org/x/sys v0.48.0 // indirect
+       golang.org/x/term v0.46.0 // indirect
        golang.org/x/time v0.14.0 // indirect
-       golang.org/x/tools v0.48.0 // indirect
+       golang.org/x/tools v0.49.0 // indirect
        google.golang.org/genproto/googleapis/api 
v0.0.0-20260803160001-6ac0973c030d // indirect
        google.golang.org/genproto/googleapis/rpc 
v0.0.0-20260803160001-6ac0973c030d // indirect
        google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // 
indirect
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/go.sum new/clusterctl-1.14.4/go.sum
--- old/clusterctl-1.14.3/go.sum        2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/go.sum        2026-11-03 09:29:50.000000000 +0100
@@ -63,8 +63,8 @@
 github.com/clipperhouse/uax29/v2 v2.6.0/go.mod 
h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
 github.com/coredns/caddy v1.1.1 h1:2eYKZT7i6yxIfGP3qLJoJ7HAsDJqYB+X68g4NYjSrE0=
 github.com/coredns/caddy v1.1.1/go.mod 
h1:A6ntJQlAWuQfFlsd9hvigKbo2WS0VUs2l1e2F+BawD4=
-github.com/coredns/corefile-migration v1.0.35 
h1:kZ4NRtenBmavOkFHCBCekxhrvoEzwAKRlNnD+9daVkI=
-github.com/coredns/corefile-migration v1.0.35/go.mod 
h1:56DPqONc3njpVPsdilEnfijCwNGC3/kTJLl7i7SPavY=
+github.com/coredns/corefile-migration v1.0.36 
h1:szNRCWf+bDe4sPz1MvHdxtA9GCburX7hg89wNtbl21I=
+github.com/coredns/corefile-migration v1.0.36/go.mod 
h1:56DPqONc3njpVPsdilEnfijCwNGC3/kTJLl7i7SPavY=
 github.com/coreos/go-semver v0.1.0/go.mod 
h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-semver v0.3.0/go.mod 
h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-semver v0.3.1 
h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
@@ -397,8 +397,8 @@
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod 
h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod 
h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod 
h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod 
h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod 
h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod 
h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod 
h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod 
h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -427,8 +427,8 @@
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod 
h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod 
h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod 
h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod 
h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -446,8 +446,8 @@
 golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod 
h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod 
h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod 
h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod 
h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod 
h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod 
h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -462,8 +462,8 @@
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod 
h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod 
h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod 
h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod 
h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod 
h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -479,18 +479,18 @@
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod 
h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod 
h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod 
h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod 
h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod 
h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod 
h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod 
h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod 
h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod 
h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod 
h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
@@ -522,8 +522,8 @@
 golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod 
h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod 
h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod 
h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod 
h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod 
h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod 
h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod 
h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod 
h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/hack/scripts/ci/ci-e2e-lib.sh 
new/clusterctl-1.14.4/hack/scripts/ci/ci-e2e-lib.sh
--- old/clusterctl-1.14.3/hack/scripts/ci/ci-e2e-lib.sh 2026-10-06 
16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/hack/scripts/ci/ci-e2e-lib.sh 2026-11-03 
09:29:50.000000000 +0100
@@ -266,9 +266,9 @@
 # the actual test run less sensible to the network speed.
 kind:prepullAdditionalImages () {
   # Pulling cert manager images so we can pre-load in kind nodes
-  kind::prepullImage "quay.io/jetstack/cert-manager-cainjector:v1.21.2"
-  kind::prepullImage "quay.io/jetstack/cert-manager-webhook:v1.21.2"
-  kind::prepullImage "quay.io/jetstack/cert-manager-controller:v1.21.2"
+  kind::prepullImage "quay.io/jetstack/cert-manager-cainjector:v1.21.3"
+  kind::prepullImage "quay.io/jetstack/cert-manager-webhook:v1.21.3"
+  kind::prepullImage "quay.io/jetstack/cert-manager-controller:v1.21.3"
 
   # Pull all images defined in DOCKER_PRELOAD_IMAGES.
   for IMAGE in $(grep DOCKER_PRELOAD_IMAGES: < "$E2E_CONF_FILE" | sed -E 
's/.*\[(.*)\].*/\1/' | tr ',' ' '); do
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/hack/scripts/ensure/ensure-kind.sh 
new/clusterctl-1.14.4/hack/scripts/ensure/ensure-kind.sh
--- old/clusterctl-1.14.3/hack/scripts/ensure/ensure-kind.sh    2026-10-06 
16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/hack/scripts/ensure/ensure-kind.sh    2026-11-03 
09:29:50.000000000 +0100
@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# This script ensures the kind is installed, and if already present, it is a 
viable version.
+# This script ensures the kind is installed, and if already present, it is the 
exact required version.
 
 set -o errexit
 set -o nounset
@@ -31,12 +31,12 @@
 goarch="$(go env GOARCH)"
 goos="$(go env GOOS)"
 
-# Note: When updating the MINIMUM_KIND_VERSION new shas MUST be added in 
`preBuiltMappings` at `test/infrastructure/kind/mapper.go`
-MINIMUM_KIND_VERSION=v0.33.0
+# Note: When updating the KIND_VERSION new shas MUST be added in 
`preBuiltMappings` at `test/infrastructure/kind/mapper.go`
+KIND_VERSION=v0.33.0
 
 # Expected sha256 for each pinned version/OS/ARCH combination. Read via 
indirect
 # expansion below, so shellcheck can't see the usage. Update these whenever
-# MINIMUM_KIND_VERSION is bumped, using the sha256sum published alongside each
+# KIND_VERSION is bumped, using the sha256sum published alongside each
 # release binary.
 # shellcheck disable=SC2034
 
KIND_SHA256_linux_amd64="aee6151561422756b764a4ae28e7f44cda5af5a9eead3cc9985112b1de8d8e0d"
@@ -51,13 +51,13 @@
 # install_kind downloads and installs the required kind version into 
GOPATH_BIN.
 install_kind() {
   if [ "$goos" == "linux" ] || [ "$goos" == "darwin" ]; then
-    echo "Installing kind ${MINIMUM_KIND_VERSION}"
+    echo "Installing kind ${KIND_VERSION}"
     if ! [ -d "${GOPATH_BIN}" ]; then
       mkdir -p "${GOPATH_BIN}"
     fi
     KIND_SHA256_VAR="KIND_SHA256_${goos}_${goarch}"
-    KIND_SHA256="${!KIND_SHA256_VAR:?no known sha256 for kind 
${MINIMUM_KIND_VERSION} on ${goos}/${goarch}, add it to $0}"
-    download_and_verify 
"https://github.com/kubernetes-sigs/kind/releases/download/${MINIMUM_KIND_VERSION}/kind-${goos}-${goarch}";
 "${KIND_SHA256}" "${GOPATH_BIN}/kind"
+    KIND_SHA256="${!KIND_SHA256_VAR:?no known sha256 for kind ${KIND_VERSION} 
on ${goos}/${goarch}, add it to $0}"
+    download_and_verify 
"https://github.com/kubernetes-sigs/kind/releases/download/${KIND_VERSION}/kind-${goos}-${goarch}";
 "${KIND_SHA256}" "${GOPATH_BIN}/kind"
     chmod +x "${GOPATH_BIN}/kind"
     verify_gopath_bin
   else
@@ -66,17 +66,17 @@
   fi
 }
 
-# verify_kind_installed checks that the kind binary resolved via PATH meets 
MINIMUM_KIND_VERSION.
+# verify_kind_installed checks that the kind binary resolved via PATH is 
exactly KIND_VERSION.
 verify_kind_installed() {
   local kind_version
   kind_version="v$(kind version -q)"
-  if [[ "${MINIMUM_KIND_VERSION}" != $(echo -e 
"${MINIMUM_KIND_VERSION}\n${kind_version}" | sort -s -t. -k 1,1n -k 2,2n -k 
3,3n | head -n1) ]]; then
-    echo "error: 'kind' in PATH resolved to ${kind_version} after install; 
expected >= ${MINIMUM_KIND_VERSION}"
+  if [[ "${kind_version}" != "${KIND_VERSION}" ]]; then
+    echo "error: 'kind' in PATH resolved to ${kind_version} after install; 
expected ${KIND_VERSION}"
     return 2
   fi
 }
 
-# Ensure the kind tool exists and is a viable version, or installs it
+# Ensure the kind tool exists and is exactly KIND_VERSION, or installs it
 verify_kind_version() {
 
   # If kind is not available on the path, get it
@@ -89,11 +89,11 @@
 
   local kind_version
   kind_version="v$(kind version -q)"
-  if [[ "${MINIMUM_KIND_VERSION}" != $(echo -e 
"${MINIMUM_KIND_VERSION}\n${kind_version}" | sort -s -t. -k 1,1n -k 2,2n -k 
3,3n | head -n1) ]]; then
+  if [[ "${kind_version}" != "${KIND_VERSION}" ]]; then
     cat <<EOF
 Detected kind version: ${kind_version}.
-Requires ${MINIMUM_KIND_VERSION} or greater.
-Installing ${MINIMUM_KIND_VERSION}.
+Requires exactly ${KIND_VERSION}.
+Installing ${KIND_VERSION}.
 EOF
     install_kind
     verify_kind_installed
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/clusterctl-1.14.3/hack/scripts/verify/verify-container-images.sh 
new/clusterctl-1.14.4/hack/scripts/verify/verify-container-images.sh
--- old/clusterctl-1.14.3/hack/scripts/verify/verify-container-images.sh        
2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/hack/scripts/verify/verify-container-images.sh        
2026-11-03 09:29:50.000000000 +0100
@@ -26,7 +26,17 @@
 
 VERSION=${1}
 GO_ARCH="$(go env GOARCH)"
-DB_MIRROR="public.ecr.aws/aquasecurity/trivy-db"
+DB_MIRRORS=(
+  "mirror.gcr.io/aquasec/trivy-db"
+  "ghcr.io/aquasecurity/trivy-db"
+  "public.ecr.aws/aquasecurity/trivy-db"
+  "aquasec/trivy-db"
+)
+
+DB_REPO_ARGS=()
+for m in "${DB_MIRRORS[@]}"; do
+  DB_REPO_ARGS+=(--db-repository="${m}")
+done
 
 REPO_ROOT=$(git rev-parse --show-toplevel)
 "${REPO_ROOT}/hack/scripts/ensure/ensure-trivy.sh" "${VERSION}"
@@ -38,12 +48,12 @@
 make clean-release-git
 
 # Scan the images
-"${TRIVY}" image --db-repository="${DB_MIRROR}" -q --exit-code 1 
--ignore-unfixed --severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/clusterctl-"${GO_ARCH}":dev && R1=$? || R1=$?
-"${TRIVY}" image --db-repository="${DB_MIRROR}" -q --exit-code 1 
--ignore-unfixed --severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/test-extension-"${GO_ARCH}":dev && R2=$? || R2=$?
-"${TRIVY}" image --db-repository="${DB_MIRROR}" -q --exit-code 1 
--ignore-unfixed --severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller-"${GO_ARCH}":dev
 && R3=$? || R3=$?
-"${TRIVY}" image --db-repository="${DB_MIRROR}" -q --exit-code 1 
--ignore-unfixed --severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller-"${GO_ARCH}":dev && 
R4=$? || R4=$?
-"${TRIVY}" image --db-repository="${DB_MIRROR}" -q --exit-code 1 
--ignore-unfixed --severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/cluster-api-controller-"${GO_ARCH}":dev && R5=$? 
|| R5=$?
-"${TRIVY}" image --db-repository="${DB_MIRROR}" -q --exit-code 1 
--ignore-unfixed --severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/capd-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
+"${TRIVY}" image "${DB_REPO_ARGS[@]}" -q --exit-code 1 --ignore-unfixed 
--severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/clusterctl-"${GO_ARCH}":dev && R1=$? || R1=$?
+"${TRIVY}" image "${DB_REPO_ARGS[@]}" -q --exit-code 1 --ignore-unfixed 
--severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/test-extension-"${GO_ARCH}":dev && R2=$? || R2=$?
+"${TRIVY}" image "${DB_REPO_ARGS[@]}" -q --exit-code 1 --ignore-unfixed 
--severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller-"${GO_ARCH}":dev
 && R3=$? || R3=$?
+"${TRIVY}" image "${DB_REPO_ARGS[@]}" -q --exit-code 1 --ignore-unfixed 
--severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller-"${GO_ARCH}":dev && 
R4=$? || R4=$?
+"${TRIVY}" image "${DB_REPO_ARGS[@]}" -q --exit-code 1 --ignore-unfixed 
--severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/cluster-api-controller-"${GO_ARCH}":dev && R5=$? 
|| R5=$?
+"${TRIVY}" image "${DB_REPO_ARGS[@]}" -q --exit-code 1 --ignore-unfixed 
--severity MEDIUM,HIGH,CRITICAL 
gcr.io/k8s-staging-cluster-api/capd-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
 
 echo ""
 BRed='\033[1;31m'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/hack/tools/go.mod 
new/clusterctl-1.14.4/hack/tools/go.mod
--- old/clusterctl-1.14.3/hack/tools/go.mod     2026-10-06 16:40:37.000000000 
+0200
+++ new/clusterctl-1.14.4/hack/tools/go.mod     2026-11-03 09:29:50.000000000 
+0100
@@ -160,15 +160,15 @@
        go.opentelemetry.io/otel v1.45.0 // indirect
        go.opentelemetry.io/otel/metric v1.45.0 // indirect
        go.opentelemetry.io/otel/trace v1.45.0 // indirect
-       golang.org/x/crypto v0.56.0 // indirect
-       golang.org/x/mod v0.38.0 // indirect
-       golang.org/x/net v0.58.0 // indirect
-       golang.org/x/sync v0.22.0 // indirect
-       golang.org/x/sys v0.47.0 // indirect
-       golang.org/x/term v0.45.0 // indirect
-       golang.org/x/text v0.41.0 // indirect
+       golang.org/x/crypto v0.57.0 // indirect
+       golang.org/x/mod v0.41.0 // indirect
+       golang.org/x/net v0.60.0 // indirect
+       golang.org/x/sync v0.23.0 // indirect
+       golang.org/x/sys v0.48.0 // indirect
+       golang.org/x/term v0.46.0 // indirect
+       golang.org/x/text v0.42.0 // indirect
        golang.org/x/time v0.15.0 // indirect
-       golang.org/x/tools v0.48.0 // indirect
+       golang.org/x/tools v0.49.0 // indirect
        gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
        google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 // 
indirect
        google.golang.org/genproto/googleapis/api 
v0.0.0-20260803160001-6ac0973c030d // indirect
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/hack/tools/go.sum 
new/clusterctl-1.14.4/hack/tools/go.sum
--- old/clusterctl-1.14.3/hack/tools/go.sum     2026-10-06 16:40:37.000000000 
+0200
+++ new/clusterctl-1.14.4/hack/tools/go.sum     2026-11-03 09:29:50.000000000 
+0100
@@ -357,12 +357,12 @@
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod 
h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod 
h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod 
h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod 
h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod 
h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod 
h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod 
h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod 
h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod 
h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@@ -370,15 +370,15 @@
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod 
h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod 
h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod 
h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod 
h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod 
h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod 
h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -392,15 +392,15 @@
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod 
h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod 
h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod 
h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod 
h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -408,16 +408,16 @@
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod 
h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod 
h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod 
h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod 
h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod 
h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod 
h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod 
h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod 
h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod 
h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/tools/go/expect v0.1.1-deprecated 
h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod 
h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated 
h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/netlify.toml 
new/clusterctl-1.14.4/netlify.toml
--- old/clusterctl-1.14.3/netlify.toml  2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/netlify.toml  2026-11-03 09:29:50.000000000 +0100
@@ -4,7 +4,7 @@
     publish = "docs/book/book"
 
 [build.environment]
-    GO_VERSION = "1.26.6"
+    GO_VERSION = "1.26.10"
 
 # Standard Netlify redirects
 [[redirects]]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/test/e2e/config/docker.yaml 
new/clusterctl-1.14.4/test/e2e/config/docker.yaml
--- old/clusterctl-1.14.3/test/e2e/config/docker.yaml   2026-10-06 
16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/test/e2e/config/docker.yaml   2026-11-03 
09:29:50.000000000 +0100
@@ -21,11 +21,11 @@
   loadBehavior: tryLoad
 - name: gcr.io/k8s-staging-cluster-api/test-extension-{ARCH}:dev
   loadBehavior: tryLoad
-- name: quay.io/jetstack/cert-manager-cainjector:v1.21.2
+- name: quay.io/jetstack/cert-manager-cainjector:v1.21.3
   loadBehavior: tryLoad
-- name: quay.io/jetstack/cert-manager-webhook:v1.21.2
+- name: quay.io/jetstack/cert-manager-webhook:v1.21.3
   loadBehavior: tryLoad
-- name: quay.io/jetstack/cert-manager-controller:v1.21.2
+- name: quay.io/jetstack/cert-manager-controller:v1.21.3
   loadBehavior: tryLoad
 
 providers:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/test/go.mod 
new/clusterctl-1.14.4/test/go.mod
--- old/clusterctl-1.14.3/test/go.mod   2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/test/go.mod   2026-11-03 09:29:50.000000000 +0100
@@ -150,17 +150,17 @@
        go.uber.org/zap v1.28.0 // indirect
        go.yaml.in/yaml/v2 v2.4.3 // indirect
        go.yaml.in/yaml/v3 v3.0.4 // indirect
-       golang.org/x/crypto v0.56.0 // indirect
+       golang.org/x/crypto v0.57.0 // indirect
        golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
-       golang.org/x/mod v0.38.0 // indirect
-       golang.org/x/net v0.58.0 // indirect
+       golang.org/x/mod v0.41.0 // indirect
+       golang.org/x/net v0.60.0 // indirect
        golang.org/x/oauth2 v0.36.0 // indirect
-       golang.org/x/sync v0.22.0 // indirect
-       golang.org/x/sys v0.47.0 // indirect
-       golang.org/x/term v0.45.0 // indirect
-       golang.org/x/text v0.41.0 // indirect
+       golang.org/x/sync v0.23.0 // indirect
+       golang.org/x/sys v0.48.0 // indirect
+       golang.org/x/term v0.46.0 // indirect
+       golang.org/x/text v0.42.0 // indirect
        golang.org/x/time v0.14.0 // indirect
-       golang.org/x/tools v0.48.0 // indirect
+       golang.org/x/tools v0.49.0 // indirect
        google.golang.org/genproto/googleapis/api 
v0.0.0-20260803160001-6ac0973c030d // indirect
        google.golang.org/genproto/googleapis/rpc 
v0.0.0-20260803160001-6ac0973c030d // indirect
        google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // 
indirect
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/clusterctl-1.14.3/test/go.sum 
new/clusterctl-1.14.4/test/go.sum
--- old/clusterctl-1.14.3/test/go.sum   2026-10-06 16:40:37.000000000 +0200
+++ new/clusterctl-1.14.4/test/go.sum   2026-11-03 09:29:50.000000000 +0100
@@ -44,8 +44,8 @@
 github.com/containerd/errdefs/pkg v0.3.0/go.mod 
h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/coredns/caddy v1.1.1 h1:2eYKZT7i6yxIfGP3qLJoJ7HAsDJqYB+X68g4NYjSrE0=
 github.com/coredns/caddy v1.1.1/go.mod 
h1:A6ntJQlAWuQfFlsd9hvigKbo2WS0VUs2l1e2F+BawD4=
-github.com/coredns/corefile-migration v1.0.35 
h1:kZ4NRtenBmavOkFHCBCekxhrvoEzwAKRlNnD+9daVkI=
-github.com/coredns/corefile-migration v1.0.35/go.mod 
h1:56DPqONc3njpVPsdilEnfijCwNGC3/kTJLl7i7SPavY=
+github.com/coredns/corefile-migration v1.0.36 
h1:szNRCWf+bDe4sPz1MvHdxtA9GCburX7hg89wNtbl21I=
+github.com/coredns/corefile-migration v1.0.36/go.mod 
h1:56DPqONc3njpVPsdilEnfijCwNGC3/kTJLl7i7SPavY=
 github.com/coreos/go-semver v0.1.0/go.mod 
h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-semver v0.3.1 
h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod 
h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
@@ -365,42 +365,42 @@
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod 
h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod 
h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod 
h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod 
h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod 
h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 
h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
 golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod 
h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod 
h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190320064053-1272bf9dcd53/go.mod 
h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod 
h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod 
h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod 
h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod 
h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod 
h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod 
h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod 
h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod 
h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod 
h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod 
h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod 
h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod 
h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod 
h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod 
h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod 
h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod 
h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -408,8 +408,8 @@
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod 
h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod 
h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod 
h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod 
h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod 
h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod 
h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod 
h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod 
h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

++++++ clusterctl.obsinfo ++++++
--- /var/tmp/diff_new_pack.yXNsbZ/_old  2026-11-05 18:22:57.109291727 +0100
+++ /var/tmp/diff_new_pack.yXNsbZ/_new  2026-11-05 18:22:57.118292102 +0100
@@ -1,5 +1,5 @@
 name: clusterctl
-version: 1.14.3
-mtime: 1791297637
-commit: 825a79dc92ddcca6acc935e233201c697a2f7488
+version: 1.14.4
+mtime: 1793694590
+commit: 4356c154f4a76b8939748ef7ebc2d0793ffe47e8
 

++++++ vendor.tar.gz ++++++
/work/SRC/openSUSE:Factory/clusterctl/vendor.tar.gz 
/work/SRC/openSUSE:Factory/.clusterctl.new.3759290/vendor.tar.gz differ: char 
129, line 1

Reply via email to