Go: Bump to v1.25.2.

[Gacko]

/triage accepted
/kind cleanup
/priority backlog

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Gacko

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Gacko]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for kubernetes-ingress-nginx canceled.

Name	Link
🔨 Latest commit	c5c0f86
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-ingress-nginx/deploys/68e5ef8feff02c0008d2dc88

[cpanato]

Flagging this. You cannot open a PR and merge yourself without any review; this is not correct. I have seen this happening for quite some time, and this is not correct. There is a process in the K8s community, and that should be followed.

If it were a one-person project, I would understand that, but there are a couple of people in this project

cc @kubernetes/steering-committee for visibility

[BenTheElder]

Flagging this. You cannot open a PR and merge yourself without any review; this is not correct. I have seen this happening for quite some time, and this is not correct. There is a process in the K8s community, and that should be followed.

Speaking personally, the steering committee can only formally respond with a majority vote. I am not signing this as steering. That holds for any comment which does not clearly state it is on behalf of steering.

We don't actually have any governance that requires this as far as I know, it's up to the subprojects. I think there are many cases for expedited merging and small CVE patches seem like one of those cases?

Disclosure: I do this myself in kind from time to time because the project is small with few maintainers and when we have decided for example to cut a release while other maintainers are busy I need to merge the checked-in files that document the release along with the git tag etc.

We have other cases for clicking merge like "CI/infra config is broken and this is the config repo".

There are other projects that do this very often, I think it depends on understanding amongst the maintainers and care should be taken for things like the CLA when clicking merge.

I don't know if that understanding exists for this project.

[Gacko]

See my DM on Slack. I can still make it public, if you want. That can be decided in the DM.

[tao12345666333]

Essentially, due to our understaffing and the current dependency updates being a routine process, relying on the regular approach could cause this task to take over two days to complete.
We agree with Marco's current approach.