dependabot[bot] opened a new pull request, #24324: URL: https://github.com/apache/camel/pull/24324
Bumps `kubernetes-client-version` from 7.7.0 to 7.8.0. Updates `io.fabric8:kubernetes-client` from 7.7.0 to 7.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fabric8io/kubernetes-client/releases";>io.fabric8:kubernetes-client's releases</a>.</em></p> <blockquote> <h2>7.8.0 (2026-06-29)</h2> <h4>Bugs</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7953";>#7953</a>: (httpclient-jdk) bodyless requests now preserve the requested HTTP method instead of silently defaulting to <code>GET</code>. <code>JdkHttpClientImpl.requestBuilder</code> only called <code>HttpRequest.Builder.method(...)</code> inside the <code>body != null</code> branch, so a bodyless <code>DELETE</code>/<code>POST</code>/<code>PUT</code>/<code>PATCH</code> (such as <code>client.raw(uri, "DELETE", null)</code>) was sent as <code>GET</code> on the JDK backend; the method is now set with <code>BodyPublishers.noBody()</code> when there is no body, matching the OkHttp, Jetty and Vert.x backends</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7435";>#7435</a>: (kubernetes-client) A <code>SharedIndexInformer</code>'s periodic resync no longer stops permanently and silently when a single resync cycle throws. <code>DefaultSharedIndexInformer.scheduleResync</code> runs the resync through <code>Utils.scheduleAtFixedRate</code>, whose self-rescheduling chain re-arms the next cycle only when the previous one completes normally; an uncaught exception completed the (unobserved) <code>resyncFuture</code> exceptionally and the resync was never scheduled again, with no log, while the independent watch kept <code>isWatching()</code> reporting <code>true</code> (a restart was required to recover). The resync command now catches and <code>WARN</code>-logs the failure so the schedule fires again at the next interval</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7933";>#7933</a>: (kubernetes-client-api) Deterministic TLS trust failures (untrusted cert, expired cert, hostname mismatch) are now classified as terminal and fail fast instead of being retried by the shared <code>StandardHttpClient.shouldRetry</code> backoff loop (~19 s drain). The classifier walks both <code>getCause()</code> and <code>getSuppressed()</code> trees for <code>CertificateException</code>, <code>CertPathValidatorException</code>, <code>CertPathBuilderException</code>, and <code>SSLPeerUnverifiedException</code>. Affects all five HTTP client modules (jdk, jetty, okhttp, vertx-4, vertx-5) on both the HTTP request and WebSocket connect paths</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7867";>#7867</a>: (kubernetes-server-mock) <code>WatchEventsListener</code> now buffers outgoing watch events that are scheduled before Vert.x fires <code>onOpen</code> and replays them once the WebSocket is available, closing the open-side race where a CRUD operation landing between <code>handleWatch</code> registering the listener and <code>onOpen</code> populating <code>webSocketRef</code> scheduled a send that dereferenced a null <code>webSocketRef</code>; the resulting <code>NullPointerException</code> was silently swallowed by the executor and the event was dropped. Buffered events are replayed after the initial-sync <code>ADDED</code>s so ordering is preserved</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7896";>#7896</a>: (kubernetes-client) <code>AbstractWatchManager.watchEnded()</code> now emits a <code>WatcherException</code> when a watch closes cleanly with no messages within 2 seconds, compensating for a GKE-specific behaviour on <code>v1/events</code> where the GKFE proxy rejects a stale <code>resourceVersion</code> with a bare WebSocket close (code 1000, no body) instead of <code>{"type":"ERROR","code":410}</code>, causing an indefinite reconnect loop with the same stale resourceVersion</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7907";>#7907</a>: (httpclient-vertx-5) WebSocket-over-TLS operations (<code>exec</code>/<code>attach</code>/<code>portForward</code>/WebSocket-backed watches, and the CRD-establishment waits that depend on them) now trust the cluster certificate again. Vert.x 5.1 rewrote the WebSocket client to resolve TLS through a per-connection <code>ClientSSLOptions</code> that ignored the custom <code>SslContextFactory</code> the client used as its sole carrier of trust material, so WebSocket handshakes silently fell back to the default JVM trust store, failed PKIX validation, and hung to the client-side timeout (regular HTTPS request/response was unaffected). Both the HTTP and WebSocket clients are now configured uniformly with Vert.x <code>TrustOptions</code>/<code>KeyCertOptions</code> derived from the supplied trust/key managers</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7873";>#7873</a>: (kube-api-test) <code>Utils.findFreePort</code> now records every port it hands out for the JVM's lifetime and skips any port already returned, eliminating the back-to-back duplicate-port window that surfaced as a <code>JUnitExtensionOnMethodTest.simpleTest2</code> flake — the probe <code>ServerSocket</code> was closed before the caller bound it, so <code>EtcdProcess.startEtcd()</code> and <code>KubeAPIServerProcess.startApiServer()</code> could draw the same port from <code>Random.nextInt</code>, etcd would win the bind, and apiserver would exit 1 with <code>bind: address already in use</code>, surfacing in <code>ProcessReadinessChecker</code> as <code>Connection reset by peer</code></li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7857";>#7857</a>: (kubernetes-server-mock) <code>WatchEventsListener.onClosing</code> now queues the server-side <code>WebSocket.close(...)</code> on the listener's send executor instead of invoking it directly on the Vert.x event loop. This preserves FIFO ordering with any data frames already queued on that executor, so events scheduled before a client-initiated watch close (e.g. an <code>ADDED</code>/<code>DELETED</code> pair on a final <code>create</code>/<code>delete</code> before <code>watch.close()</code>) are delivered before the close frame instead of being silently dropped by writes against an already-closing socket</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7832";>#7832</a>: (sonar) Re-interrupt thread in 8 production-code catch blocks that swallowed <code>InterruptedException</code> without preserving the interrupt status (S2142)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7841";>#7841</a>: (mockwebserver) split <code>Dispatcher</code> shutdown into two phases so <code>MockDispatcher</code> only tears down per-session <code>WebSocketSession</code> executors after the HTTP server has drained, removing the window where an in-flight upgrade's <code>onOpen</code> could land on a shut-down executor. <code>shutdown()</code> still runs before <code>httpServer.close()</code> to unblock blocked dispatches (e.g. <code>QueueDispatcher.take()</code>); the new <code>releaseResources()</code> runs after. <code>WebSocketSession.send()</code> additionally catches <code>RejectedExecutionException</code> defensively so any residual shutdown race stays silent instead of bubbling as a Vert.x <code>Unhandled exception</code>. <code>KubernetesMixedDispatcher</code> now delegates both lifecycle hooks to its inner <code>MockDispatcher</code>, fixing a pre-existing leak where CRUD-mode WebSocket session executors were never shut down</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7779";>#7779</a>: (kubernetes-client) ExecWebSocketListener now notifies the user-supplied ExecListener on transport-level errors that race with <code>terminateOnError</code> / channel-3 exit-status completion — <code>listener.onFailure</code> (or <code>onClose</code>) fires exactly once, gated by a dedicated flag, instead of being silently swallowed when the deferred onError task observes <code>exitCode.isDone()</code></li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7765";>#7765</a>: (kubernetes-client) <code>BaseOperation.informOnCondition</code> now stops the informer inline when the inner predicate completes the future, closing a CompletableFuture <code>postComplete</code> race where a waiter helping drain dependents could fire <code>informer.stop</code> after <code>cf.complete</code> had already triggered a spurious <code>?watch=true</code> HTTP request</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client) <code>BaseClient.addToCloseable</code> now synchronizes on the internal closeable set rather than the caller-supplied parameter, so callers cannot break mutual exclusion by passing different references (sonar S2445)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client-api) <code>KUBERNETES_SUBDOMAIN_REGEX</code> uses possessive quantifiers on the outer groups to block ReDoS-style backtracking on adversarial subdomain input; semantics still match the canonical RFC 1123 subdomain pattern (sonar S5998)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client-api) <code>Serialization.yamlMapper</code> builds the mapper into a local before assigning to the <code>volatile</code> field, so concurrent readers can no longer observe a partially-initialized instance with modules not yet registered (sonar S3064)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (mockwebserver) self-signed cert/key temp file cleanup goes through <code>Files.deleteIfExists</code> with logging instead of swallowing the <code>File.delete()</code> return value (sonar S899)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (httpclient-okhttp) <code>OkHttpClientBuilderImpl</code> now picks the first <code>X509TrustManager</code> from a multi-entry <code>TrustManager[]</code> rather than passing <code>null</code> to OkHttp's <code>sslSocketFactory</code> and NPE'ing; user-supplied <code>sslContext</code> is preserved for multi-CA setups (sonar S2637)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (httpclient-okhttp) <code>OkHttpClientImpl.doClose</code> removes dead null checks on <code>dispatcher</code> and <code>connectionPool</code> that are guaranteed non-null by the OkHttp API (sonar S2583)</li> </ul> <h4>Improvements</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7675";>#7675</a>: (mockwebserver) <code>MockWebServer.dispatcher</code> field marked <code>volatile</code> so a <code>setDispatcher(...)</code> call is reliably visible to the Vert.x request handler thread without further synchronization. <code>MockWebServer.reset()</code> Javadoc tightened to make its non-destructive contract explicit (no change to the running server, dispatcher, listeners, SSL/TLS state, port, or protocols)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7809";>#7809</a>: (kubernetes-client) Support for shard selectors for list and watch - including informers</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7837";>#7837</a>: (kubernetes-client) Follow-ups on shard selector</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7899";>#7899</a>: (kubernetes-client) Callback before re-list for Informers</li> </ul> <h4>Dependency Upgrade</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7849";>#7849</a>: bump istio.io/client-go from 1.29.2 to 1.30.0</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/autoscaler/vertical-pod-autoscaler from 1.6.0 to 1.7.0</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/gengo/v2 from 2.0.0-20251215205346-5ee0d033ba5b to 2.0.0-20260408192533-25e2208e0dc3</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/kube-openapi from 0.0.0-20260319004828-5883c5ee87b9 to 0.0.0-20260414162039-ec9c827d403f</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7875";>#7875</a>: bump vertx5.version from 5.0.12 to 5.1.1, adapting httpclient-vertx-5 to Vert.x 5.1 behaviour changes (SSL engine options no longer accept an empty protocol array; request-body stream errors are reset with HTTP/2 CANCEL so they are not retried as transient IOExceptions)</li> </ul> <h4>New Features</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7926";>#7926</a>: (httpclient-vertx-5, httpclient-vertx) opt-in TLS warm-up on the Vert.x HTTP client factory. <code>Vertx5HttpClientFactory</code>/<code>VertxHttpClientFactory</code> now expose <code>setTlsWarmup(TlsWarmup)</code> with modes <code>OFF</code>, <code>CONTEXT</code> (default, unchanged) and <code>FULL</code>. <code>FULL</code> runs a synchronous, once-per-JVM, throwaway loopback TLS handshake off the event loop when the client is built, so the first real connection no longer blocks the event loop on the one-time JDK/Netty TLS class loading — for users on cold or hard-CPU-throttled JVMs hitting the first-connection block/timeout described in <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7921";>#7921</a>. Default behavior is unchanged; see the FAQ for CDS and pod CPU-sizing guidance for hard-throttled pods</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/5084";>#5084</a>: Jbang scripts to generate graalVM metadata</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7375";>#7375</a>: (crd-generator) Support <a href="https://github.com/JsonClassDescription";><code>@JsonClassDescription</code></a> for adding descriptions to classes in the generated CRD schema.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/officialasishkumar";><code>@officialasishkumar</code></a> made their first contribution in <a href="https://redirect.github.com/fabric8io/kubernetes-client/pull/7783";>fabric8io/kubernetes-client#7783</a></li> <li><a href="https://github.com/tehaci";><code>@tehaci</code></a> made their first contribution in <a href="https://redirect.github.com/fabric8io/kubernetes-client/pull/7898";>fabric8io/kubernetes-client#7898</a></li> <li><a href="https://github.com/GrosQuildu";><code>@GrosQuildu</code></a> made their first contribution in <a href="https://redirect.github.com/fabric8io/kubernetes-client/pull/7937";>fabric8io/kubernetes-client#7937</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fabric8io/kubernetes-client/compare/v7.7.0...v7.8.0";>https://github.com/fabric8io/kubernetes-client/compare/v7.7.0...v7.8.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/fabric8io/kubernetes-client/blob/main/CHANGELOG.md";>io.fabric8:kubernetes-client's changelog</a>.</em></p> <blockquote> <h3>7.8.0 (2026-06-29)</h3> <h4>Bugs</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7953";>#7953</a>: (httpclient-jdk) bodyless requests now preserve the requested HTTP method instead of silently defaulting to <code>GET</code>. <code>JdkHttpClientImpl.requestBuilder</code> only called <code>HttpRequest.Builder.method(...)</code> inside the <code>body != null</code> branch, so a bodyless <code>DELETE</code>/<code>POST</code>/<code>PUT</code>/<code>PATCH</code> (such as <code>client.raw(uri, "DELETE", null)</code>) was sent as <code>GET</code> on the JDK backend; the method is now set with <code>BodyPublishers.noBody()</code> when there is no body, matching the OkHttp, Jetty and Vert.x backends</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7435";>#7435</a>: (kubernetes-client) A <code>SharedIndexInformer</code>'s periodic resync no longer stops permanently and silently when a single resync cycle throws. <code>DefaultSharedIndexInformer.scheduleResync</code> runs the resync through <code>Utils.scheduleAtFixedRate</code>, whose self-rescheduling chain re-arms the next cycle only when the previous one completes normally; an uncaught exception completed the (unobserved) <code>resyncFuture</code> exceptionally and the resync was never scheduled again, with no log, while the independent watch kept <code>isWatching()</code> reporting <code>true</code> (a restart was required to recover). The resync command now catches and <code>WARN</code>-logs the failure so the schedule fires again at the next interval</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7933";>#7933</a>: (kubernetes-client-api) Deterministic TLS trust failures (untrusted cert, expired cert, hostname mismatch) are now classified as terminal and fail fast instead of being retried by the shared <code>StandardHttpClient.shouldRetry</code> backoff loop (~19 s drain). The classifier walks both <code>getCause()</code> and <code>getSuppressed()</code> trees for <code>CertificateException</code>, <code>CertPathValidatorException</code>, <code>CertPathBuilderException</code>, and <code>SSLPeerUnverifiedException</code>. Affects all five HTTP client modules (jdk, jetty, okhttp, vertx-4, vertx-5) on both the HTTP request and WebSocket connect paths</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7867";>#7867</a>: (kubernetes-server-mock) <code>WatchEventsListener</code> now buffers outgoing watch events that are scheduled before Vert.x fires <code>onOpen</code> and replays them once the WebSocket is available, closing the open-side race where a CRUD operation landing between <code>handleWatch</code> registering the listener and <code>onOpen</code> populating <code>webSocketRef</code> scheduled a send that dereferenced a null <code>webSocketRef</code>; the resulting <code>NullPointerException</code> was silently swallowed by the executor and the event was dropped. Buffered events are replayed after the initial-sync <code>ADDED</code>s so ordering is preserved</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7896";>#7896</a>: (kubernetes-client) <code>AbstractWatchManager.watchEnded()</code> now emits a <code>WatcherException</code> when a watch closes cleanly with no messages within 2 seconds, compensating for a GKE-specific behaviour on <code>v1/events</code> where the GKFE proxy rejects a stale <code>resourceVersion</code> with a bare WebSocket close (code 1000, no body) instead of <code>{"type":"ERROR","code":410}</code>, causing an indefinite reconnect loop with the same stale resourceVersion</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7907";>#7907</a>: (httpclient-vertx-5) WebSocket-over-TLS operations (<code>exec</code>/<code>attach</code>/<code>portForward</code>/WebSocket-backed watches, and the CRD-establishment waits that depend on them) now trust the cluster certificate again. Vert.x 5.1 rewrote the WebSocket client to resolve TLS through a per-connection <code>ClientSSLOptions</code> that ignored the custom <code>SslContextFactory</code> the client used as its sole carrier of trust material, so WebSocket handshakes silently fell back to the default JVM trust store, failed PKIX validation, and hung to the client-side timeout (regular HTTPS request/response was unaffected). Both the HTTP and WebSocket clients are now configured uniformly with Vert.x <code>TrustOptions</code>/<code>KeyCertOptions</code> derived from the supplied trust/key managers</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7873";>#7873</a>: (kube-api-test) <code>Utils.findFreePort</code> now records every port it hands out for the JVM's lifetime and skips any port already returned, eliminating the back-to-back duplicate-port window that surfaced as a <code>JUnitExtensionOnMethodTest.simpleTest2</code> flake — the probe <code>ServerSocket</code> was closed before the caller bound it, so <code>EtcdProcess.startEtcd()</code> and <code>KubeAPIServerProcess.startApiServer()</code> could draw the same port from <code>Random.nextInt</code>, etcd would win the bind, and apiserver would exit 1 with <code>bind: address already in use</code>, surfacing in <code>ProcessReadinessChecker</code> as <code>Connection reset by peer</code></li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7857";>#7857</a>: (kubernetes-server-mock) <code>WatchEventsListener.onClosing</code> now queues the server-side <code>WebSocket.close(...)</code> on the listener's send executor instead of invoking it directly on the Vert.x event loop. This preserves FIFO ordering with any data frames already queued on that executor, so events scheduled before a client-initiated watch close (e.g. an <code>ADDED</code>/<code>DELETED</code> pair on a final <code>create</code>/<code>delete</code> before <code>watch.close()</code>) are delivered before the close frame instead of being silently dropped by writes against an already-closing socket</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7832";>#7832</a>: (sonar) Re-interrupt thread in 8 production-code catch blocks that swallowed <code>InterruptedException</code> without preserving the interrupt status (S2142)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7841";>#7841</a>: (mockwebserver) split <code>Dispatcher</code> shutdown into two phases so <code>MockDispatcher</code> only tears down per-session <code>WebSocketSession</code> executors after the HTTP server has drained, removing the window where an in-flight upgrade's <code>onOpen</code> could land on a shut-down executor. <code>shutdown()</code> still runs before <code>httpServer.close()</code> to unblock blocked dispatches (e.g. <code>QueueDispatcher.take()</code>); the new <code>releaseResources()</code> runs after. <code>WebSocketSession.send()</code> additionally catches <code>RejectedExecutionException</code> defensively so any residual shutdown race stays silent instead of bubbling as a Vert.x <code>Unhandled exception</code>. <code>KubernetesMixedDispatcher</code> now delegates both lifecycle hooks to its inner <code>MockDispatcher</code>, fixing a pre-existing leak where CRUD-mode WebSocket session executors were never shut down</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7779";>#7779</a>: (kubernetes-client) ExecWebSocketListener now notifies the user-supplied ExecListener on transport-level errors that race with <code>terminateOnError</code> / channel-3 exit-status completion — <code>listener.onFailure</code> (or <code>onClose</code>) fires exactly once, gated by a dedicated flag, instead of being silently swallowed when the deferred onError task observes <code>exitCode.isDone()</code></li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7765";>#7765</a>: (kubernetes-client) <code>BaseOperation.informOnCondition</code> now stops the informer inline when the inner predicate completes the future, closing a CompletableFuture <code>postComplete</code> race where a waiter helping drain dependents could fire <code>informer.stop</code> after <code>cf.complete</code> had already triggered a spurious <code>?watch=true</code> HTTP request</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client) <code>BaseClient.addToCloseable</code> now synchronizes on the internal closeable set rather than the caller-supplied parameter, so callers cannot break mutual exclusion by passing different references (sonar S2445)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client-api) <code>KUBERNETES_SUBDOMAIN_REGEX</code> uses possessive quantifiers on the outer groups to block ReDoS-style backtracking on adversarial subdomain input; semantics still match the canonical RFC 1123 subdomain pattern (sonar S5998)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client-api) <code>Serialization.yamlMapper</code> builds the mapper into a local before assigning to the <code>volatile</code> field, so concurrent readers can no longer observe a partially-initialized instance with modules not yet registered (sonar S3064)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (mockwebserver) self-signed cert/key temp file cleanup goes through <code>Files.deleteIfExists</code> with logging instead of swallowing the <code>File.delete()</code> return value (sonar S899)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (httpclient-okhttp) <code>OkHttpClientBuilderImpl</code> now picks the first <code>X509TrustManager</code> from a multi-entry <code>TrustManager[]</code> rather than passing <code>null</code> to OkHttp's <code>sslSocketFactory</code> and NPE'ing; user-supplied <code>sslContext</code> is preserved for multi-CA setups (sonar S2637)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (httpclient-okhttp) <code>OkHttpClientImpl.doClose</code> removes dead null checks on <code>dispatcher</code> and <code>connectionPool</code> that are guaranteed non-null by the OkHttp API (sonar S2583)</li> </ul> <h4>Improvements</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7675";>#7675</a>: (mockwebserver) <code>MockWebServer.dispatcher</code> field marked <code>volatile</code> so a <code>setDispatcher(...)</code> call is reliably visible to the Vert.x request handler thread without further synchronization. <code>MockWebServer.reset()</code> Javadoc tightened to make its non-destructive contract explicit (no change to the running server, dispatcher, listeners, SSL/TLS state, port, or protocols)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7809";>#7809</a>: (kubernetes-client) Support for shard selectors for list and watch - including informers</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7837";>#7837</a>: (kubernetes-client) Follow-ups on shard selector</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7899";>#7899</a>: (kubernetes-client) Callback before re-list for Informers</li> </ul> <h4>Dependency Upgrade</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7849";>#7849</a>: bump istio.io/client-go from 1.29.2 to 1.30.0</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/autoscaler/vertical-pod-autoscaler from 1.6.0 to 1.7.0</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/gengo/v2 from 2.0.0-20251215205346-5ee0d033ba5b to 2.0.0-20260408192533-25e2208e0dc3</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/kube-openapi from 0.0.0-20260319004828-5883c5ee87b9 to 0.0.0-20260414162039-ec9c827d403f</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7875";>#7875</a>: bump vertx5.version from 5.0.12 to 5.1.1, adapting httpclient-vertx-5 to Vert.x 5.1 behaviour changes (SSL engine options no longer accept an empty protocol array; request-body stream errors are reset with HTTP/2 CANCEL so they are not retried as transient IOExceptions)</li> </ul> <h4>New Features</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7926";>#7926</a>: (httpclient-vertx-5, httpclient-vertx) opt-in TLS warm-up on the Vert.x HTTP client factory. <code>Vertx5HttpClientFactory</code>/<code>VertxHttpClientFactory</code> now expose <code>setTlsWarmup(TlsWarmup)</code> with modes <code>OFF</code>, <code>CONTEXT</code> (default, unchanged) and <code>FULL</code>. <code>FULL</code> runs a synchronous, once-per-JVM, throwaway loopback TLS handshake off the event loop when the client is built, so the first real connection no longer blocks the event loop on the one-time JDK/Netty TLS class loading — for users on cold or hard-CPU-throttled JVMs hitting the first-connection block/timeout described in <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7921";>#7921</a>. Default behavior is unchanged; see the FAQ for CDS and pod CPU-sizing guidance for hard-throttled pods</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/5084";>#5084</a>: Jbang scripts to generate graalVM metadata</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7375";>#7375</a>: (crd-generator) Support <a href="https://github.com/JsonClassDescription";><code>@JsonClassDescription</code></a> for adding descriptions to classes in the generated CRD schema.</li> </ul> <h4><em><strong>Note</strong></em>: Breaking changes</h4> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/0d235f6616f488a55f7e77052e1a0c3edc4dd4f6";><code>0d235f6</code></a> [RELEASE] Updated project version to v7.8.0</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/4428e35f4241cab5f4e2318313f43b6993dc6276";><code>4428e35</code></a> fix(httpclient-jdk): preserve bodyless request methods (7953)</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/8171f514ccb1fce60dcc1e0d9d6b505d13c4a051";><code>8171f51</code></a> fix(kubernetes-client): keep informer resync alive after a failed cycle</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/186714516897ce5ad933a3a760ca98013487a84a";><code>1867145</code></a> chore(deps-dev): bump org.keycloak:keycloak-core in the keycloak group</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/a9fc5258768dc1d2a23bc8223192f365d50594d6";><code>a9fc525</code></a> fix(kubernetes-client-api): fail fast on deterministic TLS trust failures ins...</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/7d3ae1e7f11062b0c97f0e345b23323d214b8189";><code>7d3ae1e</code></a> fix usernames safety check</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/f9f72393ac41c1d573fa8df65af6b78e63df3e21";><code>f9f7239</code></a> chore(deps): bump io.swagger.parser.v3:swagger-parser</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/cdf82c84f285e0fb9abee6ea61a3fd1a894dcf82";><code>cdf82c8</code></a> chore(deps): bump actions/cache from 5 to 6 in the github-actions group</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/ed201add32c13b888af7189945f6c44d5a069644";><code>ed201ad</code></a> test(mockwebserver): tolerate failed connect in closeReason test (<a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7806";>#7806</a>)</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/35c191dd8d029c57f2d68071284a7afe7774e713";><code>35c191d</code></a> chore(deps-dev): bump net.bytebuddy:byte-buddy-agent</li> <li>Additional commits viewable in <a href="https://github.com/fabric8io/kubernetes-client/compare/v7.7.0...v7.8.0";>compare view</a></li> </ul> </details> <br /> Updates `io.fabric8:openshift-client` from 7.7.0 to 7.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fabric8io/kubernetes-client/releases";>io.fabric8:openshift-client's releases</a>.</em></p> <blockquote> <h2>7.8.0 (2026-06-29)</h2> <h4>Bugs</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7953";>#7953</a>: (httpclient-jdk) bodyless requests now preserve the requested HTTP method instead of silently defaulting to <code>GET</code>. <code>JdkHttpClientImpl.requestBuilder</code> only called <code>HttpRequest.Builder.method(...)</code> inside the <code>body != null</code> branch, so a bodyless <code>DELETE</code>/<code>POST</code>/<code>PUT</code>/<code>PATCH</code> (such as <code>client.raw(uri, "DELETE", null)</code>) was sent as <code>GET</code> on the JDK backend; the method is now set with <code>BodyPublishers.noBody()</code> when there is no body, matching the OkHttp, Jetty and Vert.x backends</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7435";>#7435</a>: (kubernetes-client) A <code>SharedIndexInformer</code>'s periodic resync no longer stops permanently and silently when a single resync cycle throws. <code>DefaultSharedIndexInformer.scheduleResync</code> runs the resync through <code>Utils.scheduleAtFixedRate</code>, whose self-rescheduling chain re-arms the next cycle only when the previous one completes normally; an uncaught exception completed the (unobserved) <code>resyncFuture</code> exceptionally and the resync was never scheduled again, with no log, while the independent watch kept <code>isWatching()</code> reporting <code>true</code> (a restart was required to recover). The resync command now catches and <code>WARN</code>-logs the failure so the schedule fires again at the next interval</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7933";>#7933</a>: (kubernetes-client-api) Deterministic TLS trust failures (untrusted cert, expired cert, hostname mismatch) are now classified as terminal and fail fast instead of being retried by the shared <code>StandardHttpClient.shouldRetry</code> backoff loop (~19 s drain). The classifier walks both <code>getCause()</code> and <code>getSuppressed()</code> trees for <code>CertificateException</code>, <code>CertPathValidatorException</code>, <code>CertPathBuilderException</code>, and <code>SSLPeerUnverifiedException</code>. Affects all five HTTP client modules (jdk, jetty, okhttp, vertx-4, vertx-5) on both the HTTP request and WebSocket connect paths</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7867";>#7867</a>: (kubernetes-server-mock) <code>WatchEventsListener</code> now buffers outgoing watch events that are scheduled before Vert.x fires <code>onOpen</code> and replays them once the WebSocket is available, closing the open-side race where a CRUD operation landing between <code>handleWatch</code> registering the listener and <code>onOpen</code> populating <code>webSocketRef</code> scheduled a send that dereferenced a null <code>webSocketRef</code>; the resulting <code>NullPointerException</code> was silently swallowed by the executor and the event was dropped. Buffered events are replayed after the initial-sync <code>ADDED</code>s so ordering is preserved</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7896";>#7896</a>: (kubernetes-client) <code>AbstractWatchManager.watchEnded()</code> now emits a <code>WatcherException</code> when a watch closes cleanly with no messages within 2 seconds, compensating for a GKE-specific behaviour on <code>v1/events</code> where the GKFE proxy rejects a stale <code>resourceVersion</code> with a bare WebSocket close (code 1000, no body) instead of <code>{"type":"ERROR","code":410}</code>, causing an indefinite reconnect loop with the same stale resourceVersion</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7907";>#7907</a>: (httpclient-vertx-5) WebSocket-over-TLS operations (<code>exec</code>/<code>attach</code>/<code>portForward</code>/WebSocket-backed watches, and the CRD-establishment waits that depend on them) now trust the cluster certificate again. Vert.x 5.1 rewrote the WebSocket client to resolve TLS through a per-connection <code>ClientSSLOptions</code> that ignored the custom <code>SslContextFactory</code> the client used as its sole carrier of trust material, so WebSocket handshakes silently fell back to the default JVM trust store, failed PKIX validation, and hung to the client-side timeout (regular HTTPS request/response was unaffected). Both the HTTP and WebSocket clients are now configured uniformly with Vert.x <code>TrustOptions</code>/<code>KeyCertOptions</code> derived from the supplied trust/key managers</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7873";>#7873</a>: (kube-api-test) <code>Utils.findFreePort</code> now records every port it hands out for the JVM's lifetime and skips any port already returned, eliminating the back-to-back duplicate-port window that surfaced as a <code>JUnitExtensionOnMethodTest.simpleTest2</code> flake — the probe <code>ServerSocket</code> was closed before the caller bound it, so <code>EtcdProcess.startEtcd()</code> and <code>KubeAPIServerProcess.startApiServer()</code> could draw the same port from <code>Random.nextInt</code>, etcd would win the bind, and apiserver would exit 1 with <code>bind: address already in use</code>, surfacing in <code>ProcessReadinessChecker</code> as <code>Connection reset by peer</code></li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7857";>#7857</a>: (kubernetes-server-mock) <code>WatchEventsListener.onClosing</code> now queues the server-side <code>WebSocket.close(...)</code> on the listener's send executor instead of invoking it directly on the Vert.x event loop. This preserves FIFO ordering with any data frames already queued on that executor, so events scheduled before a client-initiated watch close (e.g. an <code>ADDED</code>/<code>DELETED</code> pair on a final <code>create</code>/<code>delete</code> before <code>watch.close()</code>) are delivered before the close frame instead of being silently dropped by writes against an already-closing socket</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7832";>#7832</a>: (sonar) Re-interrupt thread in 8 production-code catch blocks that swallowed <code>InterruptedException</code> without preserving the interrupt status (S2142)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7841";>#7841</a>: (mockwebserver) split <code>Dispatcher</code> shutdown into two phases so <code>MockDispatcher</code> only tears down per-session <code>WebSocketSession</code> executors after the HTTP server has drained, removing the window where an in-flight upgrade's <code>onOpen</code> could land on a shut-down executor. <code>shutdown()</code> still runs before <code>httpServer.close()</code> to unblock blocked dispatches (e.g. <code>QueueDispatcher.take()</code>); the new <code>releaseResources()</code> runs after. <code>WebSocketSession.send()</code> additionally catches <code>RejectedExecutionException</code> defensively so any residual shutdown race stays silent instead of bubbling as a Vert.x <code>Unhandled exception</code>. <code>KubernetesMixedDispatcher</code> now delegates both lifecycle hooks to its inner <code>MockDispatcher</code>, fixing a pre-existing leak where CRUD-mode WebSocket session executors were never shut down</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7779";>#7779</a>: (kubernetes-client) ExecWebSocketListener now notifies the user-supplied ExecListener on transport-level errors that race with <code>terminateOnError</code> / channel-3 exit-status completion — <code>listener.onFailure</code> (or <code>onClose</code>) fires exactly once, gated by a dedicated flag, instead of being silently swallowed when the deferred onError task observes <code>exitCode.isDone()</code></li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7765";>#7765</a>: (kubernetes-client) <code>BaseOperation.informOnCondition</code> now stops the informer inline when the inner predicate completes the future, closing a CompletableFuture <code>postComplete</code> race where a waiter helping drain dependents could fire <code>informer.stop</code> after <code>cf.complete</code> had already triggered a spurious <code>?watch=true</code> HTTP request</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client) <code>BaseClient.addToCloseable</code> now synchronizes on the internal closeable set rather than the caller-supplied parameter, so callers cannot break mutual exclusion by passing different references (sonar S2445)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client-api) <code>KUBERNETES_SUBDOMAIN_REGEX</code> uses possessive quantifiers on the outer groups to block ReDoS-style backtracking on adversarial subdomain input; semantics still match the canonical RFC 1123 subdomain pattern (sonar S5998)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client-api) <code>Serialization.yamlMapper</code> builds the mapper into a local before assigning to the <code>volatile</code> field, so concurrent readers can no longer observe a partially-initialized instance with modules not yet registered (sonar S3064)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (mockwebserver) self-signed cert/key temp file cleanup goes through <code>Files.deleteIfExists</code> with logging instead of swallowing the <code>File.delete()</code> return value (sonar S899)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (httpclient-okhttp) <code>OkHttpClientBuilderImpl</code> now picks the first <code>X509TrustManager</code> from a multi-entry <code>TrustManager[]</code> rather than passing <code>null</code> to OkHttp's <code>sslSocketFactory</code> and NPE'ing; user-supplied <code>sslContext</code> is preserved for multi-CA setups (sonar S2637)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (httpclient-okhttp) <code>OkHttpClientImpl.doClose</code> removes dead null checks on <code>dispatcher</code> and <code>connectionPool</code> that are guaranteed non-null by the OkHttp API (sonar S2583)</li> </ul> <h4>Improvements</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7675";>#7675</a>: (mockwebserver) <code>MockWebServer.dispatcher</code> field marked <code>volatile</code> so a <code>setDispatcher(...)</code> call is reliably visible to the Vert.x request handler thread without further synchronization. <code>MockWebServer.reset()</code> Javadoc tightened to make its non-destructive contract explicit (no change to the running server, dispatcher, listeners, SSL/TLS state, port, or protocols)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7809";>#7809</a>: (kubernetes-client) Support for shard selectors for list and watch - including informers</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7837";>#7837</a>: (kubernetes-client) Follow-ups on shard selector</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7899";>#7899</a>: (kubernetes-client) Callback before re-list for Informers</li> </ul> <h4>Dependency Upgrade</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7849";>#7849</a>: bump istio.io/client-go from 1.29.2 to 1.30.0</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/autoscaler/vertical-pod-autoscaler from 1.6.0 to 1.7.0</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/gengo/v2 from 2.0.0-20251215205346-5ee0d033ba5b to 2.0.0-20260408192533-25e2208e0dc3</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/kube-openapi from 0.0.0-20260319004828-5883c5ee87b9 to 0.0.0-20260414162039-ec9c827d403f</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7875";>#7875</a>: bump vertx5.version from 5.0.12 to 5.1.1, adapting httpclient-vertx-5 to Vert.x 5.1 behaviour changes (SSL engine options no longer accept an empty protocol array; request-body stream errors are reset with HTTP/2 CANCEL so they are not retried as transient IOExceptions)</li> </ul> <h4>New Features</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7926";>#7926</a>: (httpclient-vertx-5, httpclient-vertx) opt-in TLS warm-up on the Vert.x HTTP client factory. <code>Vertx5HttpClientFactory</code>/<code>VertxHttpClientFactory</code> now expose <code>setTlsWarmup(TlsWarmup)</code> with modes <code>OFF</code>, <code>CONTEXT</code> (default, unchanged) and <code>FULL</code>. <code>FULL</code> runs a synchronous, once-per-JVM, throwaway loopback TLS handshake off the event loop when the client is built, so the first real connection no longer blocks the event loop on the one-time JDK/Netty TLS class loading — for users on cold or hard-CPU-throttled JVMs hitting the first-connection block/timeout described in <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7921";>#7921</a>. Default behavior is unchanged; see the FAQ for CDS and pod CPU-sizing guidance for hard-throttled pods</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/5084";>#5084</a>: Jbang scripts to generate graalVM metadata</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7375";>#7375</a>: (crd-generator) Support <a href="https://github.com/JsonClassDescription";><code>@JsonClassDescription</code></a> for adding descriptions to classes in the generated CRD schema.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/officialasishkumar";><code>@officialasishkumar</code></a> made their first contribution in <a href="https://redirect.github.com/fabric8io/kubernetes-client/pull/7783";>fabric8io/kubernetes-client#7783</a></li> <li><a href="https://github.com/tehaci";><code>@tehaci</code></a> made their first contribution in <a href="https://redirect.github.com/fabric8io/kubernetes-client/pull/7898";>fabric8io/kubernetes-client#7898</a></li> <li><a href="https://github.com/GrosQuildu";><code>@GrosQuildu</code></a> made their first contribution in <a href="https://redirect.github.com/fabric8io/kubernetes-client/pull/7937";>fabric8io/kubernetes-client#7937</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fabric8io/kubernetes-client/compare/v7.7.0...v7.8.0";>https://github.com/fabric8io/kubernetes-client/compare/v7.7.0...v7.8.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/fabric8io/kubernetes-client/blob/main/CHANGELOG.md";>io.fabric8:openshift-client's changelog</a>.</em></p> <blockquote> <h3>7.8.0 (2026-06-29)</h3> <h4>Bugs</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7953";>#7953</a>: (httpclient-jdk) bodyless requests now preserve the requested HTTP method instead of silently defaulting to <code>GET</code>. <code>JdkHttpClientImpl.requestBuilder</code> only called <code>HttpRequest.Builder.method(...)</code> inside the <code>body != null</code> branch, so a bodyless <code>DELETE</code>/<code>POST</code>/<code>PUT</code>/<code>PATCH</code> (such as <code>client.raw(uri, "DELETE", null)</code>) was sent as <code>GET</code> on the JDK backend; the method is now set with <code>BodyPublishers.noBody()</code> when there is no body, matching the OkHttp, Jetty and Vert.x backends</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7435";>#7435</a>: (kubernetes-client) A <code>SharedIndexInformer</code>'s periodic resync no longer stops permanently and silently when a single resync cycle throws. <code>DefaultSharedIndexInformer.scheduleResync</code> runs the resync through <code>Utils.scheduleAtFixedRate</code>, whose self-rescheduling chain re-arms the next cycle only when the previous one completes normally; an uncaught exception completed the (unobserved) <code>resyncFuture</code> exceptionally and the resync was never scheduled again, with no log, while the independent watch kept <code>isWatching()</code> reporting <code>true</code> (a restart was required to recover). The resync command now catches and <code>WARN</code>-logs the failure so the schedule fires again at the next interval</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7933";>#7933</a>: (kubernetes-client-api) Deterministic TLS trust failures (untrusted cert, expired cert, hostname mismatch) are now classified as terminal and fail fast instead of being retried by the shared <code>StandardHttpClient.shouldRetry</code> backoff loop (~19 s drain). The classifier walks both <code>getCause()</code> and <code>getSuppressed()</code> trees for <code>CertificateException</code>, <code>CertPathValidatorException</code>, <code>CertPathBuilderException</code>, and <code>SSLPeerUnverifiedException</code>. Affects all five HTTP client modules (jdk, jetty, okhttp, vertx-4, vertx-5) on both the HTTP request and WebSocket connect paths</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7867";>#7867</a>: (kubernetes-server-mock) <code>WatchEventsListener</code> now buffers outgoing watch events that are scheduled before Vert.x fires <code>onOpen</code> and replays them once the WebSocket is available, closing the open-side race where a CRUD operation landing between <code>handleWatch</code> registering the listener and <code>onOpen</code> populating <code>webSocketRef</code> scheduled a send that dereferenced a null <code>webSocketRef</code>; the resulting <code>NullPointerException</code> was silently swallowed by the executor and the event was dropped. Buffered events are replayed after the initial-sync <code>ADDED</code>s so ordering is preserved</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7896";>#7896</a>: (kubernetes-client) <code>AbstractWatchManager.watchEnded()</code> now emits a <code>WatcherException</code> when a watch closes cleanly with no messages within 2 seconds, compensating for a GKE-specific behaviour on <code>v1/events</code> where the GKFE proxy rejects a stale <code>resourceVersion</code> with a bare WebSocket close (code 1000, no body) instead of <code>{"type":"ERROR","code":410}</code>, causing an indefinite reconnect loop with the same stale resourceVersion</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7907";>#7907</a>: (httpclient-vertx-5) WebSocket-over-TLS operations (<code>exec</code>/<code>attach</code>/<code>portForward</code>/WebSocket-backed watches, and the CRD-establishment waits that depend on them) now trust the cluster certificate again. Vert.x 5.1 rewrote the WebSocket client to resolve TLS through a per-connection <code>ClientSSLOptions</code> that ignored the custom <code>SslContextFactory</code> the client used as its sole carrier of trust material, so WebSocket handshakes silently fell back to the default JVM trust store, failed PKIX validation, and hung to the client-side timeout (regular HTTPS request/response was unaffected). Both the HTTP and WebSocket clients are now configured uniformly with Vert.x <code>TrustOptions</code>/<code>KeyCertOptions</code> derived from the supplied trust/key managers</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7873";>#7873</a>: (kube-api-test) <code>Utils.findFreePort</code> now records every port it hands out for the JVM's lifetime and skips any port already returned, eliminating the back-to-back duplicate-port window that surfaced as a <code>JUnitExtensionOnMethodTest.simpleTest2</code> flake — the probe <code>ServerSocket</code> was closed before the caller bound it, so <code>EtcdProcess.startEtcd()</code> and <code>KubeAPIServerProcess.startApiServer()</code> could draw the same port from <code>Random.nextInt</code>, etcd would win the bind, and apiserver would exit 1 with <code>bind: address already in use</code>, surfacing in <code>ProcessReadinessChecker</code> as <code>Connection reset by peer</code></li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7857";>#7857</a>: (kubernetes-server-mock) <code>WatchEventsListener.onClosing</code> now queues the server-side <code>WebSocket.close(...)</code> on the listener's send executor instead of invoking it directly on the Vert.x event loop. This preserves FIFO ordering with any data frames already queued on that executor, so events scheduled before a client-initiated watch close (e.g. an <code>ADDED</code>/<code>DELETED</code> pair on a final <code>create</code>/<code>delete</code> before <code>watch.close()</code>) are delivered before the close frame instead of being silently dropped by writes against an already-closing socket</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7832";>#7832</a>: (sonar) Re-interrupt thread in 8 production-code catch blocks that swallowed <code>InterruptedException</code> without preserving the interrupt status (S2142)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7841";>#7841</a>: (mockwebserver) split <code>Dispatcher</code> shutdown into two phases so <code>MockDispatcher</code> only tears down per-session <code>WebSocketSession</code> executors after the HTTP server has drained, removing the window where an in-flight upgrade's <code>onOpen</code> could land on a shut-down executor. <code>shutdown()</code> still runs before <code>httpServer.close()</code> to unblock blocked dispatches (e.g. <code>QueueDispatcher.take()</code>); the new <code>releaseResources()</code> runs after. <code>WebSocketSession.send()</code> additionally catches <code>RejectedExecutionException</code> defensively so any residual shutdown race stays silent instead of bubbling as a Vert.x <code>Unhandled exception</code>. <code>KubernetesMixedDispatcher</code> now delegates both lifecycle hooks to its inner <code>MockDispatcher</code>, fixing a pre-existing leak where CRUD-mode WebSocket session executors were never shut down</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7779";>#7779</a>: (kubernetes-client) ExecWebSocketListener now notifies the user-supplied ExecListener on transport-level errors that race with <code>terminateOnError</code> / channel-3 exit-status completion — <code>listener.onFailure</code> (or <code>onClose</code>) fires exactly once, gated by a dedicated flag, instead of being silently swallowed when the deferred onError task observes <code>exitCode.isDone()</code></li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7765";>#7765</a>: (kubernetes-client) <code>BaseOperation.informOnCondition</code> now stops the informer inline when the inner predicate completes the future, closing a CompletableFuture <code>postComplete</code> race where a waiter helping drain dependents could fire <code>informer.stop</code> after <code>cf.complete</code> had already triggered a spurious <code>?watch=true</code> HTTP request</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client) <code>BaseClient.addToCloseable</code> now synchronizes on the internal closeable set rather than the caller-supplied parameter, so callers cannot break mutual exclusion by passing different references (sonar S2445)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client-api) <code>KUBERNETES_SUBDOMAIN_REGEX</code> uses possessive quantifiers on the outer groups to block ReDoS-style backtracking on adversarial subdomain input; semantics still match the canonical RFC 1123 subdomain pattern (sonar S5998)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (kubernetes-client-api) <code>Serialization.yamlMapper</code> builds the mapper into a local before assigning to the <code>volatile</code> field, so concurrent readers can no longer observe a partially-initialized instance with modules not yet registered (sonar S3064)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (mockwebserver) self-signed cert/key temp file cleanup goes through <code>Files.deleteIfExists</code> with logging instead of swallowing the <code>File.delete()</code> return value (sonar S899)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (httpclient-okhttp) <code>OkHttpClientBuilderImpl</code> now picks the first <code>X509TrustManager</code> from a multi-entry <code>TrustManager[]</code> rather than passing <code>null</code> to OkHttp's <code>sslSocketFactory</code> and NPE'ing; user-supplied <code>sslContext</code> is preserved for multi-CA setups (sonar S2637)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7847";>#7847</a>: (httpclient-okhttp) <code>OkHttpClientImpl.doClose</code> removes dead null checks on <code>dispatcher</code> and <code>connectionPool</code> that are guaranteed non-null by the OkHttp API (sonar S2583)</li> </ul> <h4>Improvements</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7675";>#7675</a>: (mockwebserver) <code>MockWebServer.dispatcher</code> field marked <code>volatile</code> so a <code>setDispatcher(...)</code> call is reliably visible to the Vert.x request handler thread without further synchronization. <code>MockWebServer.reset()</code> Javadoc tightened to make its non-destructive contract explicit (no change to the running server, dispatcher, listeners, SSL/TLS state, port, or protocols)</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7809";>#7809</a>: (kubernetes-client) Support for shard selectors for list and watch - including informers</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7837";>#7837</a>: (kubernetes-client) Follow-ups on shard selector</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7899";>#7899</a>: (kubernetes-client) Callback before re-list for Informers</li> </ul> <h4>Dependency Upgrade</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7849";>#7849</a>: bump istio.io/client-go from 1.29.2 to 1.30.0</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/autoscaler/vertical-pod-autoscaler from 1.6.0 to 1.7.0</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/gengo/v2 from 2.0.0-20251215205346-5ee0d033ba5b to 2.0.0-20260408192533-25e2208e0dc3</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7894";>#7894</a>: bump k8s.io/kube-openapi from 0.0.0-20260319004828-5883c5ee87b9 to 0.0.0-20260414162039-ec9c827d403f</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7875";>#7875</a>: bump vertx5.version from 5.0.12 to 5.1.1, adapting httpclient-vertx-5 to Vert.x 5.1 behaviour changes (SSL engine options no longer accept an empty protocol array; request-body stream errors are reset with HTTP/2 CANCEL so they are not retried as transient IOExceptions)</li> </ul> <h4>New Features</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7926";>#7926</a>: (httpclient-vertx-5, httpclient-vertx) opt-in TLS warm-up on the Vert.x HTTP client factory. <code>Vertx5HttpClientFactory</code>/<code>VertxHttpClientFactory</code> now expose <code>setTlsWarmup(TlsWarmup)</code> with modes <code>OFF</code>, <code>CONTEXT</code> (default, unchanged) and <code>FULL</code>. <code>FULL</code> runs a synchronous, once-per-JVM, throwaway loopback TLS handshake off the event loop when the client is built, so the first real connection no longer blocks the event loop on the one-time JDK/Netty TLS class loading — for users on cold or hard-CPU-throttled JVMs hitting the first-connection block/timeout described in <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7921";>#7921</a>. Default behavior is unchanged; see the FAQ for CDS and pod CPU-sizing guidance for hard-throttled pods</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/5084";>#5084</a>: Jbang scripts to generate graalVM metadata</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7375";>#7375</a>: (crd-generator) Support <a href="https://github.com/JsonClassDescription";><code>@JsonClassDescription</code></a> for adding descriptions to classes in the generated CRD schema.</li> </ul> <h4><em><strong>Note</strong></em>: Breaking changes</h4> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/0d235f6616f488a55f7e77052e1a0c3edc4dd4f6";><code>0d235f6</code></a> [RELEASE] Updated project version to v7.8.0</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/4428e35f4241cab5f4e2318313f43b6993dc6276";><code>4428e35</code></a> fix(httpclient-jdk): preserve bodyless request methods (7953)</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/8171f514ccb1fce60dcc1e0d9d6b505d13c4a051";><code>8171f51</code></a> fix(kubernetes-client): keep informer resync alive after a failed cycle</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/186714516897ce5ad933a3a760ca98013487a84a";><code>1867145</code></a> chore(deps-dev): bump org.keycloak:keycloak-core in the keycloak group</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/a9fc5258768dc1d2a23bc8223192f365d50594d6";><code>a9fc525</code></a> fix(kubernetes-client-api): fail fast on deterministic TLS trust failures ins...</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/7d3ae1e7f11062b0c97f0e345b23323d214b8189";><code>7d3ae1e</code></a> fix usernames safety check</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/f9f72393ac41c1d573fa8df65af6b78e63df3e21";><code>f9f7239</code></a> chore(deps): bump io.swagger.parser.v3:swagger-parser</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/cdf82c84f285e0fb9abee6ea61a3fd1a894dcf82";><code>cdf82c8</code></a> chore(deps): bump actions/cache from 5 to 6 in the github-actions group</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/ed201add32c13b888af7189945f6c44d5a069644";><code>ed201ad</code></a> test(mockwebserver): tolerate failed connect in closeReason test (<a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7806";>#7806</a>)</li> <li><a href="https://github.com/fabric8io/kubernetes-client/commit/35c191dd8d029c57f2d68071284a7afe7774e713";><code>35c191d</code></a> chore(deps-dev): bump net.bytebuddy:byte-buddy-agent</li> <li>Additional commits viewable in <a href="https://github.com/fabric8io/kubernetes-client/compare/v7.7.0...v7.8.0";>compare view</a></li> </ul> </details> <br /> Updates `io.fabric8:kubernetes-server-mock` from 7.7.0 to 7.8.0 Updates `io.fabric8:mockwebserver` from 7.7.0 to 7.8.0 Updates `io.fabric8:kubernetes-httpclient-vertx` from 7.7.0 to 7.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fabric8io/kubernetes-client/releases";>io.fabric8:kubernetes-httpclient-vertx's releases</a>.</em></p> <blockquote> <h2>7.8.0 (2026-06-29)</h2> <h4>Bugs</h4> <ul> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7953";>#7953</a>: (httpclient-jdk) bodyless requests now preserve the requested HTTP method instead of silently defaulting to <code>GET</code>. <code>JdkHttpClientImpl.requestBuilder</code> only called <code>HttpRequest.Builder.method(...)</code> inside the <code>body != null</code> branch, so a bodyless <code>DELETE</code>/<code>POST</code>/<code>PUT</code>/<code>PATCH</code> (such as <code>client.raw(uri, "DELETE", null)</code>) was sent as <code>GET</code> on the JDK backend; the method is now set with <code>BodyPublishers.noBody()</code> when there is no body, matching the OkHttp, Jetty and Vert.x backends</li> <li>Fix <a href="https://redirect.github.com/fabric8io/kubernetes-client/issues/7435";>#7435</a>: (kubernetes-client) A <code>SharedIndexInformer</code>'s periodic resync no longer... _Description has been truncated_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
