[release-1.4] 🌱 Bump github.com/onsi/gomega from 1.27.4 to 1.27.5

[k8s-infra-cherrypick-robot]

This is an automated cherry-pick of #8390

/assign killianmuldoon

[killianmuldoon]

/lgtm
/approve

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: d62a39985c73841f3cf3f1bd55c880dbf71781bc

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: killianmuldoon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [killianmuldoon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[fabriziopandini]

/hold
@killianmuldoon what about deferring backport of this bump to after the release

[killianmuldoon]

@killianmuldoon what about deferring backport of this bump to after the release

Sure - no issues with that

[killianmuldoon]

/retest
/hold remove

[killianmuldoon]

/hold cancel

[sbueringer]

I think the idea was to not backport all bumps, is there a specific reason for this one?

[killianmuldoon]

I think the idea was to not backport all bumps, is there a specific reason for this one?

I don't think there was a specific motivation - more just a preference for bumping stuff when it's easy. Will be more conservative in future.

[sbueringer]

Yeah no problem. IIRC we updated the policy recently so we only backport if we have a reason like CVE's: https://cluster-api.sigs.k8s.io/contributing#backporting-a-patch

• Dependency bumps for CVE (usually limited to CVE resolution; backports of non-CVE related version bumps are considered exceptions to be evaluated case by case)
• Cert-manager version bumps (to avoid having releases with cert-manager versions that are out of support, when possible)

Otherwise we get a flood of cherry-picks for dependencies for all supported branches. (also some of those cherry-picks would propagate to CAPI consumers)