build(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1

[dependabot]

Bumps github.com/moby/spdystream from 0.5.0 to 0.5.1.

Release notes

Sourced from github.com/moby/spdystream's releases.

v0.5.1

What's Changed

• spdy: fix duplicate license headers, add LICENSE, PATENTS, and update NOTICE moby/spdystream#106
• ci: update actions and test against latest Go versions moby/spdystream#107
• use ioutil.Discard for go1.13 compatibility moby/spdystream#109

Full Changelog: moby/spdystream@v0.5.0...v0.5.1

Commits

• c59e5d7 Merge pull request #109 from thaJeztah/use_ioutil
• 2fd0155 use ioutil.Discard for go1.13 compatibility
• ef6121f Merge commit from fork
• 241cec9 compare with signed Int for 32-bit Arm
• 21c3864 Add options to customize limits
• acf9b45 spdy: update godoc for MaxDataLength
• eb63605 spdy: limit header-size and header-count
• 2f21da4 spdy: fix header block byte accounting
• 5976b66 spdy: enforce 24-bit frame length limits
• cf0ec5d Guard against oversized SPDY frames
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by CodeRabbit

• Chores
  • Updated an indirect dependency to a newer patch version.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: a9b6ae6d-2f3a-4045-977d-df5dc20553a0

📥 Commits

Reviewing files that changed from the base of the PR and between 533aad6 and c967655.

⛔ Files ignored due to path filters (11)

• go.sum is excluded by !**/*.sum
• vendor/github.com/moby/spdystream/NOTICE is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/moby/spdystream/connection.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/moby/spdystream/spdy/LICENSE is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/moby/spdystream/spdy/PATENTS is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/moby/spdystream/spdy/dictionary.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/moby/spdystream/spdy/options.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/moby/spdystream/spdy/read.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/moby/spdystream/spdy/types.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/moby/spdystream/spdy/write.go is excluded by !vendor/**, !**/vendor/**
• vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (1)

• go.mod

---

📝 Walkthrough

Walkthrough

The go.mod file was updated to bump the indirect dependency github.com/moby/spdystream from version v0.5.0 to v0.5.1. This is a minor patch version update to the dependency. No other dependencies, require statements, or replace directives were modified.

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: bumping a dependency version from 0.5.0 to 0.5.1, which matches the changeset exactly.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	This PR only modifies go.mod to bump a dependency version and does not change any test files or Ginkgo test cases.
Test Structure And Quality	✅ Passed	PR only updates a single dependency version in go.mod (github.com/moby/spdystream from v0.5.0 to v0.5.1) with no test file modifications.
Microshift Test Compatibility	✅ Passed	The MicroShift Test Compatibility check is not applicable to this PR as it only updates a Go module dependency version and does not add or modify any test files.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Pull request contains only a dependency version bump in go.mod with no new Ginkgo e2e tests added.
Topology-Aware Scheduling Compatibility	✅ Passed	PR updates Go module dependency only; no deployment manifests, operator code, or controllers changed, so no scheduling constraints introduced.
Ote Binary Stdout Contract	✅ Passed	Dependency version bump from v0.5.0 to v0.5.1 does not modify process-level code or introduce stdout writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR only updates go.mod dependency version for github.com/moby/spdystream and adds no new Ginkgo e2e tests.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/github.com/moby/spdystream-0.5.1

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign sjenning for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[clebs]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-aks | Build: 2045032835638628352 | Cost: $2.5600976499999994 | Failed step: hypershift-azure-run-e2e

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[cwbotbot]

Test Results

e2e-aks

• Status: ✅ PASS
• Started: 2026-04-17T10:14:10Z
• View Job
• View Job History

e2e-aws

• Status: ✅ PASS
• Started: 2026-04-17T06:53:59Z
• View Job
• View Job History

[hypershift-jira-solve-ci]

I now have all the evidence needed. Let me compile the final report.

Test Failure Analysis Complete

Job Information

• Prow Job: pull-ci-openshift-hypershift-main-e2e-aks
• Build ID: 2045032835638628352
• Target: e2e-aks
• Type: presubmit (PR build(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 #8267)
• Duration: 2h 4m 30s (06:53:17Z → 08:58:48Z)
• Cluster: build01

Test Failure Analysis

Error

TestCreateClusterCustomConfig/ValidateHostedCluster — Failed to wait for 2 nodes to become ready
in 45m0s: context deadline exceeded — expected 2 nodes, got 1

Root Azure error on machine custom-config-qcqjm-xdd64-mfsn7:
  ERROR CODE: OSProvisioningTimedOut
  "OS Provisioning for VM 'custom-config-qcqjm-xdd64-mfsn7' did not finish in the allotted time."

Summary

The TestCreateClusterCustomConfig test failed because one of two Azure VMs (custom-config-qcqjm-xdd64-mfsn7) never completed OS provisioning. Azure reported OSProvisioningTimedOut after ~20 minutes (07:43:14Z → 08:03:29Z), leaving the VM in a Failed state. Although CAPI marked the machine as InfrastructureReady, the VM never successfully booted, so no corresponding Node object was created in the hosted cluster. The test waited 45 minutes for 2 nodes to become ready but only 1 node (mjxk5) joined. All other tests (TestCreateCluster, TestAutoscaling, TestNodePool, TestUpgradeControlPlane, TestHAEtcdChaos, TestAzureScheduler) passed — 325 of 327 tests passed. This is an Azure infrastructure flake completely unrelated to the PR's spdystream 0.5.0 → 0.5.1 dependency bump.

Root Cause

The failure is caused by an Azure infrastructure flake — specifically an OSProvisioningTimedOut error on one Azure VM.

Chain of events:

1. The test created HostedCluster e2e-clusters-dldjh/custom-config-qcqjm with a NodePool requesting 2 replicas
2. Two CAPI Machines were created: mfsn7 and mjxk5
3. Both AzureMachine resources were successfully provisioned with ProviderIDs and internal IPs
4. Machine mjxk5 successfully booted, registered as a Node, and became Ready
5. Machine mfsn7's Azure VM failed OS provisioning — Azure returned OSProvisioningTimedOut at 08:03:29Z after the VM was created at 07:43:14Z (~20 minutes)
6. Despite the Azure VM being in VMState: Failed, the AzureMachine resource reported Ready: True and VMRunning: True (a potential CAPZ condition-reporting gap)
7. The CAPI Machine mfsn7 stayed in Provisioned phase with NodeHealthy=False, reason=NodeProvisioning, msg="Waiting for a node with matching ProviderID to exist"
8. No Node object was ever created for mfsn7 because the VM never finished booting
9. The test waited 45 minutes for 2 nodes to become ready but only saw 1, then timed out
10. The NodePool's final status confirmed: Ready=False, "Minimum availability requires 2 replicas, current 1 available"

Why this is unrelated to the PR:

• The PR bumps github.com/moby/spdystream from 0.5.0 to 0.5.1, a pure Go dependency update
• The failure occurs at the Azure infrastructure layer (VM OS provisioning), not in any Go code path
• All 7 other top-level test suites passed successfully, including TestCreateCluster which exercises identical cluster creation logic without custom config
• The OSProvisioningTimedOut error is a well-known Azure transient issue

Recommendations

1. Retest the PR — This failure is an Azure infrastructure flake with no connection to the code changes. A /retest should resolve it.

2. No code changes needed — The spdystream dependency bump is not implicated in this failure.

3. Consider filing a tracking issue for the CAPZ condition-reporting gap: the AzureMachine reported Ready: True and VMRunning: True while the Azure VM was actually in VMState: Failed. This mismatch could delay failure detection in production.

Evidence

Evidence	Detail
Failed test	TestCreateClusterCustomConfig/ValidateHostedCluster (2881.55s)
Test result	327 tests, 39 skipped, 2 failures (parent + subtest = 1 logical failure)
All other tests	PASSED — TestCreateCluster, TestAutoscaling, TestNodePool, TestUpgradeControlPlane, TestHAEtcdChaos, TestAzureScheduler
HostedCluster	e2e-clusters-dldjh/custom-config-qcqjm — conditions valid, not degraded
NodePool	desired=2, actual=1, Ready=False: "Minimum availability requires 2 replicas, current 1 available"
Healthy machine	mjxk5 — Phase=Running, NodeRef present, NodeHealthy=True
Stuck machine	mfsn7 — Phase=Provisioned, No NodeRef, NodeHealthy=False: "Waiting for a node with matching ProviderID to exist"
AzureMachine mfsn7	VMState: Failed, ProviderID assigned, IP=10.0.0.4, but Ready: True (condition gap)
Azure error	OSProvisioningTimedOut — VM OS provisioning failed between 07:43:14Z and 08:03:29Z (~20 min)
Azure event	ReconcileError at 08:03:31Z on azuremachine-reconciler with HTTP 200 returning error code OSProvisioningTimedOut
PR change	github.com/moby/spdystream 0.5.0 → 0.5.1 (Go dependency, unrelated to Azure VM provisioning)

---

[clebs]

/test e2e-aks

[openshift-ci]

@dependabot[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bryan-cox]

/close

Included in #8334

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[openshift-ci]

@bryan-cox: Closed this PR.

Details

In response to this:

/close

Included in #8334

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.