upgrade to latest dependencies (#383)

bumping knative.dev/pkg 9c8140b...80c8bc4:
  > 80c8bc4 Add TLSMaxVersion, TLSCipherSuites, and TLSCurvePreferences to webhook.Options for enhanced TLS control (# 3300)
bumping knative.dev/serving fcb2e4d...2b62189:
  > 2b62189 Update net-kourier nightly (# 16311)
  > fcaad85 Update net-contour nightly (# 16310)
  > 753105b Update net-gateway-api nightly (# 16309)
  > 343df7e Add terminationGracePeriodSeconds support to user and sidecar container probes (# 15823) (# 16255)
  > edc1c64 Validate networking annotations on RevisionTemplateSpec (# 16296)
  > cc306d4 Prevent cross-service revision traffic routing (# 16294)
  > cc1012c Update net-istio nightly (# 16308)
  > 1e52818 upgrade to latest dependencies (# 16306)
bumping knative.dev/networking 5082b02...9b53ca0:
  > 9b53ca0 upgrade to latest dependencies (# 1104)

Signed-off-by: Knative Automation <automation@knative.team>

Author: knative-automation

go.mod

@@ -14,8 +14,8 @@ require (
 	k8s.io/client-go v0.34.3
 	k8s.io/code-generator v0.34.3
 	knative.dev/hack v0.0.0-20251126013634-1484a9e9b641
-	knative.dev/pkg v0.0.0-20251216153728-9c8140b780d1
-	knative.dev/serving v0.47.1-0.20251216154926-fcb2e4d0f74b
+	knative.dev/pkg v0.0.0-20251217214024-80c8bc434670
+	knative.dev/serving v0.47.1-0.20251218010245-2b621899e32e
 )
 
 require (
@@ -98,7 +98,7 @@ require (
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
-	knative.dev/networking v0.0.0-20251127155419-5082b02af8c1 // indirect
+	knative.dev/networking v0.0.0-20251216133826-9b53ca077e6a // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect

go.sum

@@ -261,12 +261,12 @@ k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 knative.dev/hack v0.0.0-20251126013634-1484a9e9b641 h1:N9Xqx3YLUNFN1WIc3UXTanK4je8VMQ36ZnAmECSsloc=
 knative.dev/hack v0.0.0-20251126013634-1484a9e9b641/go.mod h1:L5RzHgbvam0u8QFHfzCX6MKxu/a/gIGEdaRBqNiVbl0=
-knative.dev/networking v0.0.0-20251127155419-5082b02af8c1 h1:cZToEK7gp9ZQP+De14NFjt6874PdsrH7DH1DPxjCKVc=
-knative.dev/networking v0.0.0-20251127155419-5082b02af8c1/go.mod h1:nxN+sYiQCoT2FLgSMTShXYmYYcb7rALHSOz6l5RjCp4=
-knative.dev/pkg v0.0.0-20251216153728-9c8140b780d1 h1:pSZ4sRKm/Kq1ec+7Yhow6jUH0FKZjzrUHpPsy6Lu8pE=
-knative.dev/pkg v0.0.0-20251216153728-9c8140b780d1/go.mod h1:jU9OxeX3zL4W6aHpdMjMA/B7kgkm5JQv6PGMod2Qu/M=
-knative.dev/serving v0.47.1-0.20251216154926-fcb2e4d0f74b h1:ryyfEOYDc42GVbf5ZhikAcGg5zAXAhNu5LJNwPb1GiM=
-knative.dev/serving v0.47.1-0.20251216154926-fcb2e4d0f74b/go.mod h1:FDSziSYWrPQZ/RwX/fONtpTXZhDwXtOIBjIY5BbB7Wc=
+knative.dev/networking v0.0.0-20251216133826-9b53ca077e6a h1:IRy795/m6VioHzXIRtuYXzp7CHeF47STsP3W4++h4w0=
+knative.dev/networking v0.0.0-20251216133826-9b53ca077e6a/go.mod h1:BDVceWHtCs3jrBQzkd83vSw98zhOkO1Q7hJSuPU3hDM=
+knative.dev/pkg v0.0.0-20251217214024-80c8bc434670 h1:MKgHnTvNprMn+Tr73CRB088PqR22q4KuVFIBTLFltwA=
+knative.dev/pkg v0.0.0-20251217214024-80c8bc434670/go.mod h1:jU9OxeX3zL4W6aHpdMjMA/B7kgkm5JQv6PGMod2Qu/M=
+knative.dev/serving v0.47.1-0.20251218010245-2b621899e32e h1:GN399Z2pWdIL1uU3zU/mmnApdYwAvClu6yQjpeZ6NJU=
+knative.dev/serving v0.47.1-0.20251218010245-2b621899e32e/go.mod h1:SEhF2H2ZtmDwJNHOBi97TEiGKbF2so3/+m5prHGOu7o=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=

vendor/knative.dev/serving/pkg/apis/serving/fieldmask.go

@@ -24,6 +24,7 @@ import (
 	"slices"
 
 	corev1 "k8s.io/api/core/v1"
+
 	"knative.dev/serving/pkg/apis/config"
 )
 
@@ -384,6 +385,7 @@ func ProbeMask(in *corev1.Probe) *corev1.Probe {
 	out.PeriodSeconds = in.PeriodSeconds
 	out.SuccessThreshold = in.SuccessThreshold
 	out.FailureThreshold = in.FailureThreshold
+	out.TerminationGracePeriodSeconds = in.TerminationGracePeriodSeconds
 
 	return out
 }

vendor/knative.dev/serving/pkg/apis/serving/v1/revision_validation.go

@@ -25,6 +25,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/apimachinery/pkg/api/validation"
+	"knative.dev/networking/pkg/apis/networking"
 	"knative.dev/pkg/apis"
 	"knative.dev/pkg/kmap"
 	"knative.dev/pkg/kmp"
@@ -66,6 +67,7 @@ func (rts *RevisionTemplateSpec) Validate(ctx context.Context) *apis.FieldError
 	errs := rts.Spec.Validate(apis.WithinSpec(ctx)).ViaField("spec")
 	errs = errs.Also(autoscaling.ValidateAnnotations(ctx, config.FromContextOrDefaults(ctx).Autoscaler,
 		rts.GetAnnotations()).ViaField("metadata.annotations"))
+	errs = errs.Also(networking.ValidateAnnotations(rts.GetAnnotations()).ViaField("metadata.annotations"))
 
 	// If the RevisionTemplateSpec has a name specified, then check that
 	// it follows the requirements on the name.

vendor/knative.dev/serving/pkg/apis/serving/v1/route_lifecycle.go

@@ -155,6 +155,23 @@ func (rs *RouteStatus) MarkRevisionFailed(name string) {
 		"Revision %q failed to become ready.", name)
 }
 
+// MarkRevisionNotOwned marks the RouteConditionAllTrafficAssigned condition
+// to indicate the Revision does not belong to the expected Service.
+func (rs *RouteStatus) MarkRevisionNotOwned(revisionName, expectedService, actualService string) {
+	if actualService == "" {
+		// Revision was created from a standalone Configuration (no known service)
+		routeCondSet.Manage(rs).MarkFalse(RouteConditionAllTrafficAssigned,
+			"RevisionNotOwned",
+			"Revision %q does not belong to Service %q.", revisionName, expectedService)
+	} else {
+		// Revision belongs to a different Service
+		routeCondSet.Manage(rs).MarkFalse(RouteConditionAllTrafficAssigned,
+			"RevisionNotOwned",
+			"Revision %q belongs to Service %q, not Service %q.",
+			revisionName, actualService, expectedService)
+	}
+}
+
 // MarkMissingTrafficTarget marks the RouteConditionAllTrafficAssigned
 // condition to indicate a reference traffic target was not found.
 func (rs *RouteStatus) MarkMissingTrafficTarget(kind, name string) {

vendor/modules.txt

@@ -910,7 +910,7 @@ k8s.io/utils/trace
 # knative.dev/hack v0.0.0-20251126013634-1484a9e9b641
 ## explicit; go 1.24
 knative.dev/hack
-# knative.dev/networking v0.0.0-20251127155419-5082b02af8c1
+# knative.dev/networking v0.0.0-20251216133826-9b53ca077e6a
 ## explicit; go 1.24.0
 knative.dev/networking/pkg/apis/networking
 knative.dev/networking/pkg/apis/networking/v1alpha1
@@ -920,7 +920,7 @@ knative.dev/networking/pkg/http
 knative.dev/networking/pkg/http/header
 knative.dev/networking/pkg/http/proxy
 knative.dev/networking/pkg/http/stats
-# knative.dev/pkg v0.0.0-20251216153728-9c8140b780d1
+# knative.dev/pkg v0.0.0-20251217214024-80c8bc434670
 ## explicit; go 1.24.0
 knative.dev/pkg/apis
 knative.dev/pkg/apis/duck
@@ -959,7 +959,7 @@ knative.dev/pkg/signals
 knative.dev/pkg/system
 knative.dev/pkg/tracker
 knative.dev/pkg/websocket
-# knative.dev/serving v0.47.1-0.20251216154926-fcb2e4d0f74b
+# knative.dev/serving v0.47.1-0.20251218010245-2b621899e32e
 ## explicit; go 1.24.0
 knative.dev/serving/pkg/activator
 knative.dev/serving/pkg/apis/autoscaling