deps(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/go-logr/logr	v1.4.2 -> v1.4.3			require	patch
github.com/kubescape/kubevuln	v0.3.33 -> v0.3.82			require	patch
github.com/kubescape/storage	v0.0.111 -> v0.0.200			require	patch
github.com/onsi/ginkgo/v2	v2.20.2 -> v2.23.4			require	minor
github.com/onsi/gomega	v1.34.2 -> v1.37.0			require	minor
github.com/validator-labs/validator	v0.1.0 -> v0.1.16			require	patch
golang	1.23 -> 1.24			stage	minor
k8s.io/api	v0.31.0 -> v0.33.3			require	minor
k8s.io/apimachinery	v0.31.0 -> v0.33.3			require	minor
k8s.io/client-go	v0.31.0 -> v0.33.3			require	minor
sigs.k8s.io/cluster-api	v1.8.2 -> v1.10.4			require	minor
sigs.k8s.io/controller-runtime	v0.19.0 -> v0.21.0			require	minor

---

Release Notes

go-logr/logr (github.com/go-logr/logr)

v1.4.3

Compare Source

Minor release.

What's Changed

• Fix slog tests for 1.25 by @​hoeppi-google in https://github.com/go-logr/logr/pull/361
• Remove one exception from Slog testing by @​thockin in https://github.com/go-logr/logr/pull/362

New Contributors

• @​hoeppi-google made their first contribution in https://github.com/go-logr/logr/pull/361

Full Changelog: go-logr/logr@v1.4.2...v1.4.3

kubescape/kubevuln (github.com/kubescape/kubevuln)

v0.3.82

Compare Source

Overview

v0.3.80

Compare Source

v0.3.78

Compare Source

v0.3.77

Compare Source

v0.3.76

Compare Source

Bumps github.com/open-policy-agent/opa from 0.68.0 to 1.4.0.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.4.0

This release contains a security fix addressing CVE-2025-46569. It also includes a mix of new features, bugfixes, and dependency updates.

Security Fix: CVE-2025-46569 - OPA server Data API HTTP path injection of Rego (GHSA-6m8w-jc87-6cr7)

A vulnerability in the OPA server's Data API allows an attacker to craft the HTTP path in a way that injects Rego code into the query that is evaluated.
The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack.

Users are only impacted if all of the following apply:

• OPA is deployed as a standalone server (rather than being used as a Go library)
• The OPA server is exposed outside of the local host in an untrusted environment.
• The configured authorization policy does not do exact matching of the input.path attribute when deciding if the request should be allowed.

or, if all of the following apply:

• OPA is deployed as a standalone server.
• The service connecting to OPA allows 3rd parties to insert unsanitised text into the path of the HTTP request to OPA’s Data API.

Note: With no Authorization Policy configured for restricting API access (the default configuration), the RESTful Data API provides access for managing Rego policies; and the RESTful Query API facilitates advanced queries. Full access to these APIs provides both simpler, and broader access than what the security issue describes here can facilitate. As such, OPA servers exposed to a network are not considered affected by the attack described here if they are knowingly not restricting access through an Authorization Policy.

This issue affects all versions of OPA prior to 1.4.0.

See the Security Advisory for more details.

Reported by @​​GamrayW, @​​HyouKash, @​​AdrienIT, authored by @​​johanfylling

Runtime, Tooling, SDK

• ast: Adding rego_v1 feature to --v0-compatible capabilities (#​7474) authored by @​​johanfylling
• executable: Add version and icon to OPA windows executable (#​3171) authored by @​​sspaink reported by @​​christophwille
• format: Don't panic on format due to unexpected comments (#​6330) authored by @​​sspaink reported by @​​sirpi
• format: Avoid modifying strings when formatting (#​6220) authored by @​​sspaink reported by @​​zregvart
• plugins/status: FIFO buffer channel for status events to prevent slow status API blocking (#​7522) authored by @​​sspaink

Topdown and Rego

• gqlparser: Add JSON annotation in internal/gqlparser/ast to Position fields (#​7509) authored by @​​robmyersrobmyers
• graphql: Cache GraphQL schema parse results (#​7457) authored by @​​robmyersrobmyers
• topdown: Handling default functions in Partial Eval (#​7220) authored by @​​johanfylling
• topdown: Fix wall clock time init for PartialRun() (#​7490) authored by @​​srenatus
• topdown: Zero alloc lower/upper unless changed (#​7472) authored by @​​anderseknert

Docs, Website, Ecosystem

• adopters: Cloudsmith adds support for OPA (#​7498) authored by @​​ndouglas-cloudsmith

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.4.0

This release contains a security fix addressing CVE-2025-46569. It also includes a mix of new features, bugfixes, and dependency updates.

Security Fix: CVE-2025-46569 - OPA server Data API HTTP path injection of Rego (GHSA-6m8w-jc87-6cr7)

A vulnerability in the OPA server's Data API allows an attacker to craft the HTTP path in a way that injects Rego code into the query that is evaluated.
The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack.

Users are only impacted if all of the following apply:

• OPA is deployed as a standalone server (rather than being used as a Go library)
• The OPA server is exposed outside of the local host in an untrusted environment.
• The configured authorization policy does not do exact matching of the input.path attribute when deciding if the request should be allowed.

or, if all of the following apply:

• OPA is deployed as a standalone server.
• The service connecting to OPA allows 3rd parties to insert unsanitised text into the path of the HTTP request to OPA’s Data API.

Note: With no Authorization Policy configured for restricting API access (the default configuration), the RESTful Data API provides access for managing Rego policies; and the RESTful Query API facilitates advanced queries. Full access to these APIs provides both simpler, and broader access than what the security issue describes here can facilitate. As such, OPA servers exposed to a network are not considered affected by the attack described here if they are knowingly not restricting access through an Authorization Policy.

This issue affects all versions of OPA prior to 1.4.0.

See the Security Advisory for more details.

Reported by @​​GamrayW, @​​HyouKash, @​​AdrienIT, authored by @​​johanfylling

Runtime, Tooling, SDK

• ast: Adding rego_v1 feature to --v0-compatible capabilities (#​7474) authored by @​​johanfylling
• executable: Add version and icon to OPA windows executable (#​3171) authored by @​​sspaink reported by @​​christophwille
• format: Don't panic on format due to unexpected comments (#​6330) authored by @​​sspaink reported by @​​sirpi
• format: Avoid modifying strings when formatting (#​6220) authored by @​​sspaink reported by @​​zregvart
• plugins/status: FIFO buffer channel for status events to prevent slow status API blocking (#​7522) authored by @​​sspaink

Topdown and Rego

• gqlparser: Add JSON annotation in internal/gqlparser/ast to Position fields (#​7509) authored by @​​robmyersrobmyers
• graphql: Cache GraphQL schema parse results (#​7457) authored by @​​robmyersrobmyers
• topdown: Handling default functions in Partial Eval (#​7220) authored by @​​johanfylling
• topdown: Fix wall clock time init for PartialRun() (#​7490) authored by @​​srenatus
• topdown: Zero alloc lower/upper unless changed (#​7472) authored by @​​anderseknert

Docs, Website, Ecosystem

... (truncated)

Commits

• 8b07202 Prepare v1.4.0 release (#​7541)
• ad20632 Merge commit from fork
• 24ff9cf fix: return the raw strings when formatting (#​7525)
• 254f3bf fix(status plugin): make sure the latest status is read before manually trigg...
• 9b5f601 docs: fix post merge badge (#​7532)
• e490277 docs: Point path versioned requests to new sites (#​7531)
• d65888c plugins/status: FIFO buffer channel for status events to prevent slow status ...
• eb77d10 docs: update edge links to use /docs/edge/ path (#​7529)
• f07d604 docs: Set versioned docs links to point to archive (#​7528)
• 828b8cb docs: improve request headers documentation in REST APIs (#​7524)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

v0.3.75

Compare Source

Please see kubescape/kubescape#1834

v0.3.74

Compare Source

Bumps github.com/cilium/cilium from 1.16.8 to 1.16.9.

Release notes

Sourced from github.com/cilium/cilium's releases.

1.16.9

Summary of Changes

Minor Changes:

• Reject IPSec key rotation with mismatching key lengths to prevent IPv6 disruptions. (Backport PR cilium/cilium#38400, Upstream PR cilium/cilium#37936, @​​smagnani96)
• Skip WireGuard traffic in the BPF SNAT processing, slightly reducing pressure on the BPF Connection tracking and NAT maps. (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#35900, @​​smagnani96)

Bugfixes:

• bpf: wireguard: avoid ipcache lookup for source's security identity (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#38592, @​​julianwiedmann)
• Fix panic caused in dual cluster setups where LRPs with skipRedirectFromBackend flag set to true are installed and IPv6 is disabled. (Backport PR cilium/cilium#38701, Upstream PR cilium/cilium#38656, @​​aditighag)
• For configurations with --enable-identity-mark=false, don't attempt to retrieve the source identity from skb->mark. (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#38737, @​​julianwiedmann)

CI Changes:

• build: update golangci-lint to v2.0.0 (Backport PR cilium/cilium#38631, Upstream PR cilium/cilium#38473, @​​mhofstetter)
• ci: build CI images within merge group (Backport PR cilium/cilium#38525, Upstream PR cilium/cilium#38065, @​​marseel)
• ci: prepare CI Image build for being required (Backport PR cilium/cilium#38525, Upstream PR cilium/cilium#38320, @​​marseel)
• Clear traced UDP v4/v6 connections on check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38264, @​​smagnani96)
• Ensure packet protocol before using L4 ports in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38290, @​​smagnani96)
• Extend tracing with IP length and whether src/dst pod are CiliumInternalIP in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38281, @​​smagnani96)
• Fix checked L4 port for UDP IPv6 packets in check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38265, @​​smagnani96)
• Fix endianness for WireGuard UDP traffic in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38292, @​​smagnani96)
• Fix erroneous TCP RST condition when no TCP packets in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38291, @​​smagnani96)
• gh: aws-cni: set --enable-identity-mark=false option (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#38738, @​​julianwiedmann)
• gh: ci-e2e-upgrade: Add encryption leak checks for wireguard (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#37551, @​​jschwinger233)
• gh: update naming for bpftrace leak detection script (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#37865, @​​julianwiedmann)
• Introduce tracing log info for ICMP v4/v6 packets in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38278, @​​smagnani96)
• Manual encap checks for when $skb->encapsulation is unset in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38293, @​​smagnani96)
• Print skb pointer and correlate timestamp for subsequent trace logs in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38266, @​​smagnani96)
• Refactoring and code comments for the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38263, @​​smagnani96)
• Report masqueraded flow through proxy in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38297, @​​smagnani96)
• Shift header references when encap and move leak check on CiliumInternalIP in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38280, @​​smagnani96)
• Skip tracking DNS proxy connection with CiliumInternalIPs for IPSec in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38289, @​​smagnani96)
• Skip tracking DNS proxy connection with CiliumInternalIPs for IPSec in the check-encryption-leak script. (Backport PR cilium/cilium#38525, Upstream PR cilium/cilium#38289, @​​smagnani96)
• Skip tracking TCP proxy connection with CiliumInternalIPs for IPSec in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38287, @​​smagnani96)
• Split TCP-related leak report into a separate log line with also seq/ack n. in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38268, @​​smagnani96)
• test: Update FQDN related domain and IP (Backport PR cilium/cilium#38770, Upstream PR cilium/cilium#38754, @​​sayboras)

Misc Changes:

• cilium/cilium#38496@​​ferozsalam)
• cilium/cilium#38323@​​ferozsalam)
• cilium/cilium#38404@​​ferozsalam)
• cilium/cilium#38781@​​ferozsalam)
• bpf: host: identify Cilium's Wireguard traffic as from HOST (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#37956, @​​julianwiedmann)
• bpf: let MARK_MAGIC_EGW_DONE carry source identity (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#38430, @​​julianwiedmann)
• cilium/cilium#38347@​​cilium-renovate[bot])
• cilium/cilium#38515@​​cilium-renovate[bot])
• cilium/cilium#38346@​​cilium-renovate[bot])
• cilium/cilium#38304@​​cilium-renovate[bot])
• cilium/cilium#38442@​​cilium-renovate[bot])

... (truncated)

Changelog

Sourced from github.com/cilium/cilium's changelog.

v1.16.9

Summary of Changes

Minor Changes:

• Reject IPSec key rotation with mismatching key lengths to prevent IPv6 disruptions. (Backport PR cilium/cilium#38400, Upstream PR cilium/cilium#37936, @​​smagnani96)
• Skip WireGuard traffic in the BPF SNAT processing, slightly reducing pressure on the BPF Connection tracking and NAT maps. (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#35900, @​​smagnani96)

Bugfixes:

• bpf: wireguard: avoid ipcache lookup for source's security identity (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#38592, @​​julianwiedmann)
• Fix panic caused in dual cluster setups where LRPs with skipRedirectFromBackend flag set to true are installed and IPv6 is disabled. (Backport PR cilium/cilium#38701, Upstream PR cilium/cilium#38656, @​​aditighag)
• For configurations with --enable-identity-mark=false, don't attempt to retrieve the source identity from skb->mark. (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#38737, @​​julianwiedmann)

CI Changes:

• build: update golangci-lint to v2.0.0 (Backport PR cilium/cilium#38631, Upstream PR cilium/cilium#38473, @​​mhofstetter)
• ci: build CI images within merge group (Backport PR cilium/cilium#38525, Upstream PR cilium/cilium#38065, @​​marseel)
• ci: prepare CI Image build for being required (Backport PR cilium/cilium#38525, Upstream PR cilium/cilium#38320, @​​marseel)
• Clear traced UDP v4/v6 connections on check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38264, @​​smagnani96)
• Ensure packet protocol before using L4 ports in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38290, @​​smagnani96)
• Extend tracing with IP length and whether src/dst pod are CiliumInternalIP in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38281, @​​smagnani96)
• Fix checked L4 port for UDP IPv6 packets in check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38265, @​​smagnani96)
• Fix endianness for WireGuard UDP traffic in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38292, @​​smagnani96)
• Fix erroneous TCP RST condition when no TCP packets in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38291, @​​smagnani96)
• gh: aws-cni: set --enable-identity-mark=false option (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#38738, @​​julianwiedmann)
• gh: ci-e2e-upgrade: Add encryption leak checks for wireguard (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#37551, @​​jschwinger233)
• gh: update naming for bpftrace leak detection script (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#37865, @​​julianwiedmann)
• Introduce tracing log info for ICMP v4/v6 packets in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38278, @​​smagnani96)
• Manual encap checks for when $skb->encapsulation is unset in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38293, @​​smagnani96)
• Print skb pointer and correlate timestamp for subsequent trace logs in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38266, @​​smagnani96)
• Refactoring and code comments for the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38263, @​​smagnani96)
• Report masqueraded flow through proxy in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38297, @​​smagnani96)
• Shift header references when encap and move leak check on CiliumInternalIP in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38280, @​​smagnani96)
• Skip tracking DNS proxy connection with CiliumInternalIPs for IPSec in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38289, @​​smagnani96)
• Skip tracking DNS proxy connection with CiliumInternalIPs for IPSec in the check-encryption-leak script. (Backport PR cilium/cilium#38525, Upstream PR cilium/cilium#38289, @​​smagnani96)
• Skip tracking TCP proxy connection with CiliumInternalIPs for IPSec in the check-encryption-leak script. (Backport PR cilium/cilium#38521, Upstream PR cilium/cilium#38287, @​​smagnani96)
• Split TCP-related leak report into a separate log line with also seq/ack n. in the check-encryption-leak script. (Backport PR cilium/cilium#38741, Upstream PR cilium/cilium#38268, @​​smagnani96)
• test: Update FQDN related domain and IP (Backport PR cilium/cilium#38770, Upstream PR cilium/cilium#38754, @​​sayboras)

Misc Changes:

• cilium/cilium#38496@​​ferozsalam)
• cilium/cilium#38323@​​ferozsalam)
• cilium/cilium#38404@​​ferozsalam)
• cilium/cilium#38781@​​ferozsalam)
• bpf: host: identify Cilium's Wireguard traffic as from HOST (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#37956, @​​julianwiedmann)
• bpf: let MARK_MAGIC_EGW_DONE carry source identity (Backport PR cilium/cilium#38747, Upstream PR cilium/cilium#38430, @​​julianwiedmann)
• cilium/cilium#38347@​​cilium-renovate[bot])
• cilium/cilium#38515@​​cilium-renovate[bot])
• cilium/cilium#38346@​​cilium-renovate[bot])
• cilium/cilium#38304@​​cilium-renovate[bot])

... (truncated)

Commits

• bf7387b Prepare for release v1.16.9
• b2de936 chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1744305...
• 6249545 images: update cilium-{runtime,builder}
• e65cdcf chore(deps): update docker.io/library/golang:1.23.8 docker digest to 4f3bd60
• 4157586 images: update cilium-{runtime,builder}
• ff4ea72 chore(deps): update all-dependencies
• 420eff5 lrp: Add IP family checks
• 786ed0d docs: clarify hubble flow filter match semantics
• b35bb43 docs: remove endpointRoutes for aws-cni chaining
• ad52b68 chore(deps): update stable lvh-images
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

v0.3.72

Compare Source

What's Changed

• fix: load config from path specified in env by @​ian-fox in https://github.com/kubescape/kubevuln/pull/284
• merge labels and annotations in RetryOnConflict by @​matthyx in https://github.com/kubescape/kubevuln/pull/285
• add artifact type label to generated SBOMs by @​matthyx in https://github.com/kubescape/kubevuln/pull/286

New Contributors

• @​ian-fox made their first contribution in https://github.com/kubescape/kubevuln/pull/284

Full Changelog: kubescape/kubevuln@v0.3.69...v0.3.72

[`v0.3.69

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 71 additional dependencies were updated

Details:

Package	Change
github.com/anchore/go-logger	v0.0.0-20230725134548-c21dafa1ec5a -> v0.0.0-20241205183533-4fc29b5832e7
github.com/anchore/packageurl-go	v0.1.1-0.20240312213626-055233e539b4 -> v0.1.1-0.20241018175412-5c22e6360c4f
github.com/anchore/stereoscope	v0.0.3-0.20240423181235-8b297badafd5 -> v0.0.11
github.com/anchore/syft	v1.3.0 -> v1.18.1
github.com/armosec/armoapi-go	v0.0.416 -> v0.0.512
github.com/armosec/gojay	v1.2.15 -> v1.2.17
github.com/armosec/utils-go	v0.0.57 -> v0.0.58
github.com/armosec/utils-k8s-go	v0.0.26 -> v0.0.30
github.com/bmatcuk/doublestar/v4	v4.6.1 -> v4.7.1
github.com/briandowns/spinner	v1.23.0 -> v1.23.1
github.com/containerd/errdefs	v0.1.0 -> v1.0.0
github.com/docker/cli	v24.0.7+incompatible -> v27.4.0+incompatible
github.com/docker/docker	v27.1.1+incompatible -> v27.4.0+incompatible
github.com/emicklei/go-restful/v3	v3.12.1 -> v3.12.2
github.com/evanphx/json-patch/v5	v5.9.0 -> v5.9.11
github.com/fatih/color	v1.17.0 -> v1.18.0
github.com/fsnotify/fsnotify	v1.7.0 -> v1.8.0
github.com/gabriel-vasile/mimetype	v1.4.3 -> v1.4.7
github.com/github/go-spdx/v2	v2.2.0 -> v2.3.2
github.com/gobuffalo/flect	v1.0.2 -> v1.0.3
github.com/google/cel-go	v0.20.1 -> v0.22.0
github.com/google/go-cmp	v0.6.0 -> v0.7.0
github.com/google/go-containerregistry	v0.20.1 -> v0.20.2
github.com/google/pprof	v0.0.0-20240827171923-fa2c70bbbfe5 -> v0.0.0-20250403155104-27863c87afa6
github.com/grpc-ecosystem/grpc-gateway/v2	v2.20.0 -> v2.26.1
github.com/klauspost/compress	v1.17.9 -> v1.17.11
github.com/kubescape/go-logger	v0.0.22 -> v0.0.23
github.com/kubescape/k8s-interface	v0.0.162 -> v0.0.191
github.com/pelletier/go-toml/v2	v2.2.2 -> v2.2.3
github.com/pierrec/lz4/v4	v4.1.15 -> v4.1.22
github.com/prometheus/client_golang	v1.19.1 -> v1.20.5
github.com/prometheus/common	v0.55.0 -> v0.61.0
github.com/sagikazarmark/locafero	v0.4.0 -> v0.7.0
github.com/spf13/afero	v1.11.0 -> v1.12.0
github.com/spf13/cast	v1.6.0 -> v1.7.1
github.com/spf13/cobra	v1.8.1 -> v1.9.1
github.com/spf13/pflag	v1.0.5 -> v1.0.6
github.com/spf13/viper	v1.19.0 -> v1.20.0
github.com/stoewer/go-strcase	v1.2.0 -> v1.3.0
github.com/stripe/stripe-go/v74	v74.28.0 -> v74.30.0
github.com/sylabs/squashfs	v0.6.1 -> v1.0.4
github.com/uptrace/opentelemetry-go-extra/otelutil	v0.2.2 -> v0.3.2
github.com/uptrace/opentelemetry-go-extra/otelzap	v0.2.2 -> v0.3.2
github.com/uptrace/uptrace-go	v1.18.0 -> v1.30.1
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.53.0 -> v0.58.0
go.opentelemetry.io/contrib/instrumentation/runtime	v0.44.0 -> v0.55.0
go.opentelemetry.io/otel	v1.28.0 -> v1.35.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace	v1.18.0 -> v1.30.0
go.opentelemetry.io/otel/metric	v1.28.0 -> v1.35.0
go.opentelemetry.io/otel/sdk	v1.28.0 -> v1.35.0
golang.org/x/crypto	v0.26.0 -> v0.36.0
golang.org/x/exp	v0.0.0-20240719175910-8a7402abbf56 -> v0.0.0-20241217172543-b2144cdd0a67
golang.org/x/net	v0.28.0 -> v0.37.0
golang.org/x/oauth2	v0.21.0 -> v0.28.0
golang.org/x/sync	v0.8.0 -> v0.12.0
golang.org/x/sys	v0.24.0 -> v0.32.0
golang.org/x/term	v0.23.0 -> v0.30.0
golang.org/x/text	v0.17.0 -> v0.23.0
golang.org/x/time	v0.5.0 -> v0.8.0
golang.org/x/tools	v0.24.0 -> v0.31.0
gomodules.xyz/jsonpatch/v2	v2.4.0 -> v2.5.0
google.golang.org/genproto/googleapis/api	v0.0.0-20240528184218-531527333157 -> v0.0.0-20250218202821-56aae31c358a
google.golang.org/genproto/googleapis/rpc	v0.0.0-20240701130421-f6361c86f094 -> v0.0.0-20250218202821-56aae31c358a
k8s.io/apiextensions-apiserver	v0.31.0 -> v0.32.3
k8s.io/apiserver	v0.31.0 -> v0.32.3
k8s.io/component-base	v0.31.0 -> v0.32.3
k8s.io/kube-openapi	v0.0.0-20240228011516-70dd3763d340 -> v0.0.0-20241105132330-32ad38e42d3f
k8s.io/utils	v0.0.0-20240711033017-18e509b52bc8 -> v0.0.0-20241210054802-24370beab758
sigs.k8s.io/apiserver-network-proxy/konnectivity-client	v0.30.3 -> v0.31.0
sigs.k8s.io/json	v0.0.0-20221116044647-bc3834ca7abd -> v0.0.0-20241014173422-cfa47c3a1cc8
sigs.k8s.io/structured-merge-diff/v4	v4.4.1 -> v4.5.0

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: module github.com/kubescape/[email protected] requires go >= 1.23.8; switching to go1.23.11
go: downloading go1.23.11 (linux/amd64)
go: download go1.23.11: golang.org/[email protected]: verifying module: checksum database disabled by GOSUMDB=off