Skip to content

Release cortex 0.6.9 - #1367

Merged
PhilippMatthes merged 13 commits into
releasefrom
main
Oct 15, 2026
Merged

Release cortex 0.6.9#1367
PhilippMatthes merged 13 commits into
releasefrom
main

Conversation

@PhilippMatthes

@PhilippMatthes PhilippMatthes commented Oct 15, 2026 •
edited by cortex-ai-agents Bot
Loading

Copy link
Copy Markdown
Member

Release cortex 0.6.9

Release 2026-10-15 — PR #1367

Bumped Versions

Package Version
cortex 0.6.8 → 0.6.9
cortex-postgres 0.6.27 → 0.6.28
cortex-shim 0.1.32 → 0.1.33
bundles 0.0.106 → 0.0.107
cortex-placement-shim 0.1.32 → 0.1.33

Security Fixes

  • github.com/google/cel-go upgraded from v0.29.2 to v0.30.0 — fixes GHSA-gcjh-h69q-9w9g (JSON private fields exposed via NativeTypes / ParseStructTag).
  • github.com/moby/sys/user upgraded from v0.4.0 to v0.4.1 — fixes CVE-2026-61801, a medium-severity (CVSS 5.5) DoS via unbounded parsing of user/group database files.

Features

  • CR VM live-migration slot weigher (#981) — New kvm_cr_migration_slot weigher that steers Capacity Reservation VM live migrations toward hosts that can accommodate the reservation slot (either an existing compatible slot or enough free capacity for the reconciler to move it). Includes a new cortex_nova_weigh_cr_migration_slot_requests_total metric and is wired into all 4 KVM pipelines. (Julius Clausnitzer & Marcel)
  • VM resource handler in nova pipeline (#1362) — Adds a VirtualMachineHandler to the nova pipeline controller that creates or merge-updates a virtual machine resource after each scheduling request. (Philipp Matthes)
  • VCenter field on VMwareHostDetails (#1356) — Adds a VCenter field to VMwareHostDetails and updates VMware infrastructure metrics accordingly. (Markus Wieland)

Chores & Fixes

  • Migrate from Plutono to Perses (#1363) — Replaces the Plutono dashboarding stack with Perses, removing all Plutono assets and adding new Perses JSON dashboards. (Markus Wieland)
  • Remove large runner from workflows (#1360) — Fixes CI workflows by removing references to a large runner. (Markus Wieland)
  • Avoid review comments on outdated language features (#1361) — Updates the AI review agent prompt to stop flagging valid modern Go syntax (e.g. new()) as uncompilable. (Philipp Matthes)

Dependency Updates

  • github.com/sapcc/go-bits — digest update c011033 → 416f3ad (#1358)
  • kube-prometheus-stack — 92.3.0 → 92.7.0 (#1359, #1364, #1365)

Dependencies

renovate Bot and others added 12 commits October 13, 2026 19:41
@renovate
Renovate: Update module github.com/google/cel-go to v0.30.0 [SECURITY] (
40c7186 
#1355)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [github.com/google/cel-go](https://redirect.github.com/google/cel-go)
| `v0.29.2` → `v0.30.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgoogle%2fcel-go/v0.30.0?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/go/github.com%2fgoogle%2fcel-go/v0.30.0?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/go/github.com%2fgoogle%2fcel-go/v0.29.2/v0.30.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgoogle%2fcel-go/v0.29.2/v0.30.0?slim=true)
|

---

### JSON private fields exposed via NativeTypes and ParseStructTag in
github.com/google/cel-go

[GHSA-gcjh-h69q-9w9g](https://redirect.github.com/advisories/GHSA-gcjh-h69q-9w9g)
/ [GO-2026-6094](https://pkg.go.dev/vuln/GO-2026-6094)

<details>
<summary>More information</summary>

#### Details
JSON private fields exposed via NativeTypes and ParseStructTag in
github.com/google/cel-go

#### Severity
Unknown

#### References
-
[https://github.com/cel-expr/cel-go/security/advisories/GHSA-gcjh-h69q-9w9g](https://redirect.github.com/cel-expr/cel-go/security/advisories/GHSA-gcjh-h69q-9w9g)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-6094) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Release Notes

<details>
<summary>google/cel-go (github.com/google/cel-go)</summary>

###
[`v0.30.0`](https://redirect.github.com/google/cel-go/compare/v0.29.2...v0.30.0)

[Compare
Source](https://redirect.github.com/google/cel-go/compare/v0.29.2...v0.30.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Berlin)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cobaltcore-dev/cortex).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
Renovate: Update module github.com/moby/sys/user to v0.4.1 [SECURITY] (…
20d992d 
…#1354)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [github.com/moby/sys/user](https://redirect.github.com/moby/sys) |
`v0.4.0` → `v0.4.1` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fmoby%2fsys%2fuser/v0.4.1?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/go/github.com%2fmoby%2fsys%2fuser/v0.4.1?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/go/github.com%2fmoby%2fsys%2fuser/v0.4.0/v0.4.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fmoby%2fsys%2fuser/v0.4.0/v0.4.1?slim=true)
|

---

### github.com/moby/sys/user has a possible DoS via unbounded parsing of
user and group database files
[CVE-2026-61801](https://nvd.nist.gov/vuln/detail/CVE-2026-61801) /
[GHSA-mjcv-p78q-w5fw](https://redirect.github.com/advisories/GHSA-mjcv-p78q-w5fw)

<details>
<summary>More information</summary>

#### Details
A denial-of-service (DoS) vulnerability exists in
`github.com/moby/sys/user` before v0.4.1 when parsing specially crafted
user or group database files. An attacker able to supply a malicious
`/etc/passwd` or `/etc/group`-style file may cause excessive memory
consumption, potentially resulting in process termination due to Out Of
Memory (OOM) conditions.

This issue is related to containerd [CVE-2026-47262] /
[GHSA-jpcc-p29g-p8mq](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq),
which describes one practical exploitation path through processing
untrusted container image content. Applications using
`github.com/moby/sys/user` to parse untrusted user or group database
files may be similarly affected.

##### Impact

`github.com/moby/sys/user` versions before v0.4.1 do not place
sufficient limits on entries while parsing user and group database
files. A specially crafted file may cause excessive memory consumption,
potentially leading to process termination due to Out Of Memory (OOM)
conditions.

Applications that use `github.com/moby/sys/user` to parse user-supplied
or otherwise untrusted `/etc/passwd` or `/etc/group` files may be
affected. The severity depends on whether an attacker can influence the
contents of files being parsed.

##### Patches

This issue is fixed in `github.com/moby/sys/user` v0.4.1. Users should
upgrade to v0.4.1 or later.

##### Workarounds

Avoid parsing attacker-controlled `/etc/passwd` or `/etc/group`-style
files with affected versions of `github.com/moby/sys/user`.

Applications that must process untrusted user or group database files
should validate and limit accepted input before parsing. Upgrading to
v0.4.1 or later is the recommended remediation.

##### References

* containerd CVE-2026-47262 / GHSA-jpcc-p29g-p8mq:
GHSA-jpcc-p29g-p8mq
* Fix in `github.com/moby/sys/user`:
https://github.com/moby/sys/user/commit/210d32ba2bcb4544ee968c7f31249fe59796e60b

#### Severity
- CVSS Score: 5.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw](https://redirect.github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw)
-
[https://github.com/moby/sys/pull/221](https://redirect.github.com/moby/sys/pull/221)
-
[https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe](https://redirect.github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe)
-
[https://github.com/advisories/GHSA-mjcv-p78q-w5fw](https://redirect.github.com/advisories/GHSA-mjcv-p78q-w5fw)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-mjcv-p78q-w5fw)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### github.com/moby/sys/user has a possible DoS via unbounded parsing of
user and group database files
[CVE-2026-61801](https://nvd.nist.gov/vuln/detail/CVE-2026-61801) /
[GHSA-mjcv-p78q-w5fw](https://redirect.github.com/advisories/GHSA-mjcv-p78q-w5fw)

<details>
<summary>More information</summary>

#### Details
A denial-of-service (DoS) vulnerability exists in
`github.com/moby/sys/user` before v0.4.1 when parsing specially crafted
user or group database files. An attacker able to supply a malicious
`/etc/passwd` or `/etc/group`-style file may cause excessive memory
consumption, potentially resulting in process termination due to Out Of
Memory (OOM) conditions.

This issue is related to containerd [CVE-2026-47262] /
[GHSA-jpcc-p29g-p8mq](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq),
which describes one practical exploitation path through processing
untrusted container image content. Applications using
`github.com/moby/sys/user` to parse untrusted user or group database
files may be similarly affected.

##### Impact

`github.com/moby/sys/user` versions before v0.4.1 do not place
sufficient limits on entries while parsing user and group database
files. A specially crafted file may cause excessive memory consumption,
potentially leading to process termination due to Out Of Memory (OOM)
conditions.

Applications that use `github.com/moby/sys/user` to parse user-supplied
or otherwise untrusted `/etc/passwd` or `/etc/group` files may be
affected. The severity depends on whether an attacker can influence the
contents of files being parsed.

##### Patches

This issue is fixed in `github.com/moby/sys/user` v0.4.1. Users should
upgrade to v0.4.1 or later.

##### Workarounds

Avoid parsing attacker-controlled `/etc/passwd` or `/etc/group`-style
files with affected versions of `github.com/moby/sys/user`.

Applications that must process untrusted user or group database files
should validate and limit accepted input before parsing. Upgrading to
v0.4.1 or later is the recommended remediation.

##### References

* containerd CVE-2026-47262 / GHSA-jpcc-p29g-p8mq:
GHSA-jpcc-p29g-p8mq
* Fix in `github.com/moby/sys/user`:
https://github.com/moby/sys/user/commit/210d32ba2bcb4544ee968c7f31249fe59796e60b

#### Severity
- CVSS Score: 5.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw](https://redirect.github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw)
-
[https://github.com/moby/sys/pull/221](https://redirect.github.com/moby/sys/pull/221)
-
[https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe](https://redirect.github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe)
- [https://github.com/moby/sys](https://redirect.github.com/moby/sys)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-mjcv-p78q-w5fw) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>moby/sys (github.com/moby/sys/user)</summary>

###
[`v0.4.1`](https://redirect.github.com/moby/sys/releases/tag/user/v0.4.1)

#### What's Changed

- user: prevent possible DoS via unbounded parsing of user and group
database files in CVE-2026-61801 /
[GHSA-mjcv-p78q-w5fw](https://redirect.github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw).
This fixes a similar issue as CVE-2026-47262 in containerd.
- user: prevent falling back to looking up numeric usernames and improve
handling of numeric user/group to prevent looking up numeric values as
usernames. This fixes a similar issue as CVE-2026-46680 in containerd.
[#&#8203;221](https://redirect.github.com/moby/sys/pull/221)
- user: bump Go to 1.18, modernize
[#&#8203;198](https://redirect.github.com/moby/sys/pull/198)
- user: make code a bit more DRY
[#&#8203;225](https://redirect.github.com/moby/sys/pull/225)
- user: test cleanups
[#&#8203;226](https://redirect.github.com/moby/sys/pull/226)

**Full Changelog**:
<moby/sys@user/v0.4.0...user/v0.4.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Berlin)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cobaltcore-dev/cortex).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
Renovate: Update github.com/sapcc/go-bits digest to 605f183 (#1358)
5a6b927 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/sapcc/go-bits](https://redirect.github.com/sapcc/go-bits)
| require | digest | `c011033` → `416f3ad` |

---

### Configuration

📅 **Schedule**: (in timezone Europe/Berlin)

- Branch creation
  - "after 6pm every weekday,every weekend,before 8am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cobaltcore-dev/cortex).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
Renovate: Update kube-prometheus-stack Docker tag to v92.3.1 (#1359)
4adb745 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
|
[kube-prometheus-stack](https://redirect.github.com/prometheus-operator/kube-prometheus)
([source](https://redirect.github.com/prometheus-community/helm-charts))
| patch | `92.3.0` → `92.3.1` |

---

### Release Notes

<details>
<summary>prometheus-community/helm-charts
(kube-prometheus-stack)</summary>

###
[`v92.3.1`](https://redirect.github.com/prometheus-community/helm-charts/releases/tag/kube-prometheus-stack-92.3.1)

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards,
and Prometheus rules combined with documentation and scripts to provide
easy to operate end-to-end Kubernetes cluster monitoring with Prometheus
using the Prometheus Operator.

##### What's Changed

- \[kube-prometheus-stack] Update kube-prometheus-stack dependency
non-major updates by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;7363](https://redirect.github.com/prometheus-community/helm-charts/pull/7363)

**Full Changelog**:
<prometheus-community/helm-charts@prometheus-conntrack-stats-exporter-0.5.41...kube-prometheus-stack-92.3.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Berlin)

- Branch creation
  - "after 6pm every weekday,every weekend,before 8am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cobaltcore-dev/cortex).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@SoWieMarkus
fix: remove large runner from workflows (#1360)
4f3aa35 
Signed-off-by: Markus Wieland <markus.wieland@sap.com>
@PhilippMatthes
Avoid review comments on outdated language features (#1361)
eca9083 
The review agent made comments related to the new `new()` golang feature
and didn't recognize it, marking it as not compilable. Compilability
should be checked not by the review agent, but instead by separate
workflows.

Signed-off-by: Philipp Matthes <p.matthes@sap.com>
@SoWieMarkus
chore: Migrate from Plutono to Perses (#1363)
505f1ae 
Signed-off-by: Markus Wieland <markus.wieland@sap.com>
@SoWieMarkus
feat: add VCenter field to VMwareHostDetails and update vmware infras…
d1f8649 
…tructure metrics (#1356)

Signed-off-by: Markus Wieland <markus.wieland@sap.com>
@renovate
Renovate: Update kube-prometheus-stack Docker tag to v92.6.0 (#1364)
830963b 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
|
[kube-prometheus-stack](https://redirect.github.com/prometheus-operator/kube-prometheus)
([source](https://redirect.github.com/prometheus-community/helm-charts))
| minor | `92.3.1` → `92.6.0` |

---

### Release Notes

<details>
<summary>prometheus-community/helm-charts
(kube-prometheus-stack)</summary>

###
[`v92.6.0`](https://redirect.github.com/prometheus-community/helm-charts/releases/tag/kube-prometheus-stack-92.6.0)

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards,
and Prometheus rules combined with documentation and scripts to provide
easy to operate end-to-end Kubernetes cluster monitoring with Prometheus
using the Prometheus Operator.

#### What's Changed

- \[kube-prometheus-stack] Update ghcr.io/jkroepke/kube-webhook-certgen
Docker tag to v1.11.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;7372](https://redirect.github.com/prometheus-community/helm-charts/pull/7372)

**Full Changelog**:
<prometheus-community/helm-charts@kube-prometheus-stack-92.5.0...kube-prometheus-stack-92.6.0>

###
[`v92.5.0`](https://redirect.github.com/prometheus-community/helm-charts/releases/tag/kube-prometheus-stack-92.5.0)

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards,
and Prometheus rules combined with documentation and scripts to provide
easy to operate end-to-end Kubernetes cluster monitoring with Prometheus
using the Prometheus Operator.

#### What's Changed

- \[kube-prometheus-stack] Update kube-prometheus-stack dependency
non-major updates by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;7369](https://redirect.github.com/prometheus-community/helm-charts/pull/7369)

**Full Changelog**:
<prometheus-community/helm-charts@kube-prometheus-stack-92.4.0...kube-prometheus-stack-92.5.0>

###
[`v92.4.0`](https://redirect.github.com/prometheus-community/helm-charts/releases/tag/kube-prometheus-stack-92.4.0)

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards,
and Prometheus rules combined with documentation and scripts to provide
easy to operate end-to-end Kubernetes cluster monitoring with Prometheus
using the Prometheus Operator.

#### What's Changed

- \[kube-prometheus-stack] Update prometheus-node-exporter Docker tag to
v4.60.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;7367](https://redirect.github.com/prometheus-community/helm-charts/pull/7367)

**Full Changelog**:
<prometheus-community/helm-charts@prometheus-29.37.0...kube-prometheus-stack-92.4.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Berlin)

- Branch creation
  - "after 6pm every weekday,every weekend,before 8am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cobaltcore-dev/cortex).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
Renovate: Update kube-prometheus-stack Docker tag to v92.7.0 (#1365)
41509d6 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
|
[kube-prometheus-stack](https://redirect.github.com/prometheus-operator/kube-prometheus)
([source](https://redirect.github.com/prometheus-community/helm-charts))
| minor | `92.6.0` → `92.7.0` |

---

### Release Notes

<details>
<summary>prometheus-community/helm-charts
(kube-prometheus-stack)</summary>

###
[`v92.7.0`](https://redirect.github.com/prometheus-community/helm-charts/releases/tag/kube-prometheus-stack-92.7.0)

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards,
and Prometheus rules combined with documentation and scripts to provide
easy to operate end-to-end Kubernetes cluster monitoring with Prometheus
using the Prometheus Operator.

#### What's Changed

- \[kube-prometheus-stack] Update grafana Docker tag to v13.6.0 by
[@&#8203;renovate](https://redirect.github.com/renovate)\[bot] in
[#&#8203;7375](https://redirect.github.com/prometheus-community/helm-charts/pull/7375)

**Full Changelog**:
<prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.45.0...kube-prometheus-stack-92.7.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Berlin)

- Branch creation
  - "after 6pm every weekday,every weekend,before 8am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cobaltcore-dev/cortex).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@PhilippMatthes @cortex-ai-agents
Create vm resources as part of nova pipeline execution (#1362)
ccca27e 
This adds a `VirtualMachineHandler` to the nova pipeline controller,
executed after the pipeline has processed the scheduling request as part
of the `processMu` mutex. The handler maps our scheduling request and
the processed result into a virtual machine resource. If no such
resource exists, the handler creates it. If it already exists, the
handler performs a merge of the new fields into the existing resource.

---------

Signed-off-by: Philipp Matthes <p.matthes@sap.com>
Co-authored-by: cortex-ai-agents[bot] <279748396+cortex-ai-agents[bot]@users.noreply.github.com>
@juliusclausnitzer @mblos
feat(reservations): steer CR VM live migrations toward reservation sl…
a616d90 
…ot hosts (#981)

### Summary

- Adds `kvm_cr_migration_slot` weigher that nudges live migrations of CR
VMs toward
hosts that can accommodate the VM's reservation slot — either by already
having a
compatible CR slot, or by having enough free capacity for the slot to
follow via
  the reconciler
- Adds `cortex_nova_weigh_cr_migration_slot_requests_total` metric
tracking per-migration
  outcome: `slot_found`, `no_slot`, `no_source_slot`
- Wires the weigher into all 4 KVM pipelines

### Motivation

When a CR VM migrates, its reservation slot stays behind on the source
host until the
reconciler catches up — temporarily double-blocking resources. Steering
migrations toward
hosts that can accommodate the slot (either existing slot or free
capacity) avoids or
shortens this window.

The reconciler already handles moving reservations after migration. This
weigher only
influences where the VM lands.

### Behaviour

Only activates for `LiveMigrationIntent`. For each candidate host:

| Condition | Weight |
|---|---|
| Host has a ready CR slot (same project + resource group) with enough
remaining capacity | `slotHostWeight` (default 0.1) |
| Host has enough free capacity to absorb the slot when the reconciler
moves it | `slotHostWeight` (default 0.1) |
| Host can accommodate neither | `defaultHostWeight` (default 0.0,
neutral) |

Both weights are configurable via pipeline params. Start small; raise
based on the
alert (follow-up) once metric data shows how often a good host is found.

### Out of scope

- Multi-VM reservation slots (#211)
- Pessimistic blocking for migration targets (#214)
- Alert on high reservation-drift ratio (follow-up)

---------

Signed-off-by: Julius Clausnitzer <julius.clausnitzer@sap.com>
Signed-off-by: juliusclausnitzer <julius.clausnitzer@sap.com>
Co-authored-by: Marcel <156897072+mblos@users.noreply.github.com>
@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

🚀 Release workflow triggered — the release agent is preparing the release for this PR.

@cortex-ai-agents cortex-ai-agents Bot mentioned this pull request Oct 15, 2026
Merged
3 tasks
@cortex-ai-agents cortex-ai-agents Bot changed the title Release Release cortex 0.6.8 Oct 15, 2026
@cortex-ai-agents @claude
Release cortex 0.6.8 (#1368)
1ddf949 
## Summary

- Release prep for #1367: changelog entry and helm chart version bumps
- Bumps cortex `0.6.7` → `0.6.8`, cortex-postgres `0.6.26` → `0.6.27`,
cortex-shim `0.1.31` → `0.1.32`, bundles `0.0.105` → `0.0.106`,
cortex-placement-shim `0.1.31` → `0.1.32`
- Adds changelog entry documenting security fixes, features, chores, and
dependency updates

> **Merge this before merging #1367.**

## Test plan

- [ ] Verify all 10 `Chart.yaml` files have correct version bumps
- [ ] Verify `CHANGELOG.md` entry is well-formed and references the
correct PRs
- [ ] Confirm helm chart dependency versions are consistent across
bundles

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: cortex-ai-agents[bot] <279748396+cortex-ai-agents[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

🚀 Release workflow triggered — the release agent is preparing the release for this PR.

@PhilippMatthes
PhilippMatthes marked this pull request as ready for review October 15, 2026 14:06
@PhilippMatthes
PhilippMatthes merged commit d83e6b2 into release Oct 15, 2026
29 checks passed
@cortex-ai-agents cortex-ai-agents Bot mentioned this pull request Oct 15, 2026
Closed
3 tasks
@cortex-ai-agents cortex-ai-agents Bot changed the title Release cortex 0.6.8 Release cortex 0.6.9 Oct 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SoWieMarkus SoWieMarkus SoWieMarkus approved these changes
@umswmayj umswmayj umswmayj approved these changes
@mblos mblos mblos approved these changes
@auhlig auhlig Awaiting requested review from auhlig auhlig is a code owner
@juliusclausnitzer juliusclausnitzer Awaiting requested review from juliusclausnitzer juliusclausnitzer is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@PhilippMatthes @SoWieMarkus @umswmayj @mblos @juliusclausnitzer