chore(deps): update all non-major dependencies - autoclosed

[renovate]

This PR contains the following updates:

Package	Update	Change
anchore/grype	minor	v0.74.6 -> v0.92.2
gitea	minor	10.1.1 -> 10.6.0
k3s-io/k3s	minor	v1.28.4+k3s2 -> v1.33.1+k3s1
weaveworks/eksctl	minor	v0.170.0 -> v0.210.0

---

Release Notes

anchore/grype (anchore/grype)

v0.92.2

Compare Source

Bug Fixes

• unpin dockerfile base images to prevent wget TLS errors [#​2671 @​spiffcs]
• Parse java group ID and artifact ID from PURL when missing [#​2675 @​wagoodman]
• Grype can't update DB in docker volume (regression) [#​2517 #​2672 @​willmurphyscode]

Additional Changes

• Remove getDB() from the v6 DB reader [#​2669 @​wagoodman]

(Full Changelog)

v0.92.1

Compare Source

(Full Changelog)

v0.92.0

Compare Source

Added Features

• improve html template [#​2635 @​OnceUponALoop]
• Add EPSS metrics to grype results [#​1973 #​2587 @​wagoodman]
• Show indication of known exploited vulnerabilities (from CISA) [#​1511 #​2587 @​wagoodman]

Bug Fixes

• adjust namespace translation logic to be v5 compatible [#​2634 @​westonsteimel]
• fall back to fuzzy constraint units [#​2651 @​willmurphyscode]
• adjust version prefix check when excluding overlapping packages [#​2653 @​westonsteimel]
• Dropping group from npm package names leads to false positives [#​2554 #​2645 @​kzantow]
• Potential regression in CVE detection from 0.87.0 (v5 schema) to 0.88.0 (v6 schema) for go-module detection [#​2642]
• Removal of temporary files not working on Windows [#​2233 #​2657 @​popey]
• @​jridgewell/gen-mapping incorrectly attributed GHSA-8rmg-jf7p-4p22 [#​1886 #​2645 @​kzantow]
• Vulnerability reported on @​group/name dependency when actual vulnerability exists on name dependency [#​1701 #​2645 @​kzantow]
• Grype false negatives in versions v0.88.0 and later leading to missed critical vulnerabilities [#​2628 #​2645 @​kzantow]
• PHP pecl redis mixes with redis project itself and creates false positive cve [#​1804]
• False Positive: Openssl CVE-2022-2068, CVE-2022-1292, CVE-2021-3711 in SUSE Enterprise 15 SP5 [#​1729]
• Grype does not handle purl file input with packages from different distributions [#​2630 #​2639 @​chovanecadam]
• grype pkg:golang/k8s.io/[email protected] does not show cve [#​2580 #​2586 @​goatwu1993]

(Full Changelog)

v0.91.2

Compare Source

Bug Fixes

• Various false positives starting with 0.91.1 [#​2618 #​2621 @​willmurphyscode]

(Full Changelog)

v0.91.1

Compare Source

Bug Fixes

• Assume that empty versions should match on all possible versions [#​2591 @​wagoodman]
• Fix severity field in db search vuln [#​2589 @​wagoodman]
• Recover from panic within a matcher [#​2590 @​wagoodman]
• Should only check maven central if pom info is missing [#​2216 #​2547 @​tdunlap607]
• grype db search GHSA-mrrh-fwg8-r2c3 doesn't return results [#​2530]
• Grype stopped reporting vulnerabilities after upgrade [#​2608 #​2610 @​willmurphyscode]
• Grype does not handle cache-dir containing ~ correctly [#​2599 #​2600 @​kzantow]
• Grype should expand ~ in paths in config file [#​2024 #​2600 @​kzantow]
• False Positive: Multiple old CVEs in chromium 134.0.6998.117 for apk ecosystem [#​2581]
• Missing grype DB update from 2025041 [#​2593]
• Does not fill in the Level field of the SARIF result object [#​2511 #​2571 @​bdovaz]

Additional Changes

• add timing info to log output [#​2597 @​kzantow]
• Replace os.ReadDir with afero.ReadDir for consistency [#​2579 @​joe-ton]

(Full Changelog)

v0.91.0

Compare Source

Added Features

• Add v5 namespace emulation to db search output [#​2539 @​wagoodman]
• Add CVSS metrics in search JSON output [#​2568 @​wagoodman]
• Exit with a different return code for a failed scan [#​1922]

Bug Fixes

• Use data driven approach when detecting Alpine:edge and Debian:sid [#​2556 @​wagoodman]
• db list should render out full URLs for text format [#​2553 @​wagoodman]
• grype db import fails since v0.88 and above [#​2542 #​2546 @​kzantow]

(Full Changelog)

v0.90.0

Compare Source

Added Features

• Match vulnerabilities by distro name when no version specified [#​2521 #​2534 @​kzantow]
• Allow DB import from a URL [#​2134 #​2532 @​wagoodman]
• Add the DB url to the JSON descriptor block [#​356 #​2529 @​wagoodman]

(Full Changelog)

v0.89.1

Compare Source

Bug Fixes

• Ensure fatal error from maven search bubbles up [#​2518 @​luhring]
• Source URLs missing/broken in output with latest release [#​2520 #​2523 @​kzantow]
• Grype results set a vulnerability as its own related vulnerability [#​2514 #​2515 @​kzantow]

(Full Changelog)

v0.89.0

Compare Source

[!IMPORTANT]
As of Grype v0.88.0, the listing file which hosts the URLs of databases to download has migrated from https://toolbox-data.anchore.io/grype/databases/listing.json to https://grype.anchore.io/databases/v6/latest.json.

Added Features

• Show suggested fixed version when there are multiple listed [#​2264 #​2271 @​tomersein]

Bug Fixes

• Check for vulnerability database update failed with unsupported protocol scheme when referencing local file [#​2507 #​2508 @​wagoodman]

(Full Changelog)

v0.88.0

Compare Source

[!IMPORTANT]
With #​2126 the listing file which hosts the URLs of databases to download has migrated from https://toolbox-data.anchore.io/grype/databases/listing.json to https://grype.anchore.io/databases/v6/latest.json.

Added Features

• Add KEV information to v6 DB [#​2464 @​wagoodman]
• Add pretty format option [#​2406 @​tomersein]
• Add configuration for maven rate limit functionality [#​2397 @​rawlingsj]
• Allow specifying literal CPEs via the CLI [#​2463 @​wagoodman]
• Add KEV & EPSS to db search schema [#​2481 @​wagoodman]
• Update vulnerability matchers to use v6 DB schema [#​2132 #​2311 @​kzantow]
• Configure and use new V6 DB distribution URLs [#​2126 #​2439 @​kzantow]

Bug Fixes

• fix golang 1.24 versions when not semver compliant [#​2486 @​xnox]
• error out on maven search rate limiting [#​2460 @​luhring]
• CPE search failed when considering target software for unknown package type [#​2434 #​2438 @​westonsteimel]
• Grype Does Not Clean TMPDIR When Running in a Docker Container [#​2500]
• GetMavenPackageBySha can be rate limited by maven central, grype will silently fail which results in inconsistent scan results [#​2383]
• Grype exits with error on JSON output with PURL input [#​2360]
• Removal of temporary files not working on Windows [#​2233 #​2439 @​kzantow]
• grype db status reports "valid" when the DB is missing [#​2077 #​2439 @​kzantow]
• grype db status doesn't always check the db's checksum and validity [#​1648 #​2439 @​kzantow]
• False positive of CVE-2023-45853 on apt zlib1g/now 1:1.2.13.dfsg-1 package [#​2412 #​2474 @​westonsteimel]
• GHSA-93ww-43rr-79v3 / CVE-2024-10039 does not get patched version [#​2408]
• "grype config" output swaps comments for search-indexed-archives / search-unindexed-archives [#​2409 #​2414 @​spiffcs]

Breaking Changes

• Remove DB schema v3 and v4 code [#​2435 @​wagoodman]
• Replace grype db diff with grype db search --modified-after and --published-after flags [#​2129 #​2439 @​kzantow]

Additional Changes

• Refactor presenters to use static model over dynamic lookups [#​2492 @​wagoodman]
• update syft to 1.20 [#​2473 @​kzantow]

(Full Changelog)

v0.87.0

Compare Source

Added Features

• Question: Custom Vulnerability Sources CSAF [#​2337]
• vex: Add package name to VEX product identifiers [#​1905 #​2355 @​ferozsalam]

Bug Fixes

• fix upstream match for linux-.-headers-. [#​2320 @​barnuri]
• external-sources: throttle requests to maven central to avoid being rate limited for large sets of java dependencies [#​2384 @​rawlingsj]
• Clean up config help text [#​2347 @​wagoodman]

(Full Changelog)

v0.86.1

Compare Source

Security Fixes

• archiver has been archived - replace with archives fork [#​2304 #​2313 @​spiffcs]

Bug Fixes

• archiver has been archived - replace with archives fork [#​2304 #​2313 @​spiffcs]
• Grype panics on certain output formats for PURL inputs [#​2324 #​2328 @​willmurphyscode]
• FP of upstream linux [#​2326]

Additional Changes

• move v5-specific interfaces and implementations to the v5 package [#​2322 @​kzantow]
• Fix broken link to cosign documentation [#​2321 @​uaqben]

(Full Changelog)

v0.86.0

Compare Source

Added Features

• Add missing package information for Sarif report [#​2267 #​2254 @​GeorgeLS]

Bug Fixes

• ignore linux-aws-headers-.* as well like linux-headers-.* [#​2295 @​barnuri]

Breaking Changes

• Remove DB v1 & v2 schemas [#​2278 @​wagoodman]

Additional Changes

• refactor v5-specific code out of core packages [#​2299 @​kzantow]

(Full Changelog)

v0.85.0

Compare Source

Added Features

• Add support for gradle in Java [#​2236]
• Prefer direct match information over indirect matches [#​1931 #​2241 @​wagoodman]

Bug Fixes

• Restore log on UI teardown [#​2248 @​wagoodman]
• Display warnings even when -v is not passed and no tty is present [#​2180 #​2268 @​willmurphyscode]

Additional Changes

• core dependencies: latest syft v1.17.0 and latest stereoscope v0.0.9 [#​2275 @​willmurphyscode]

(Full Changelog)

v0.84.0

Compare Source

Added Features

• Add support for scanning single purl from the CLI [#​2225 #​2223 @​wagoodman]

Bug Fixes

• Flaky checks on STDIN for purl provider [#​2192 #​2223 @​wagoodman]
• Missing alpine patch version yields inaccurate results [#​2222 #​2226 @​wagoodman]

Additional Changes

• update Syft to v1.16.0 [#​2237 @​anchore-actions-token-generator]

(Full Changelog)

v0.83.0

Compare Source

Added Features

• Merge config files hierarchically and add support for config profiles [#​2009 #​2194 @​kzantow]
• Add DB providers command [#​2131 #​2174 @​ADorigi]

(Full Changelog)

v0.82.2

Compare Source

Bug Fixes

• azurelinux considered as comprehensive distro [#​2197 @​westonsteimel]
• Java archive cataloger performance in 0.82.x much slower than 0.81.0 [#​2200]

Additional Changes

• Update to Syft v1.14.2 [#​2203 @​wagoodman]

(Full Changelog)

v0.82.1

Compare Source

Bug Fixes

• Skip matching on packages with missing version info [#​2182 @​wagoodman]
• correctly identify version of traefik binaries [#​2178 #​2179 @​westonsteimel]
• RPM version comparison oddity with release field [#​398 #​2188 @​wagoodman]
• purl with epoch should be used even if version is missing epoch [#​2170 #​2186 @​wagoodman]

Additional Changes

• bump syft in quality gate to v1.14.0 [#​2187 @​westonsteimel]

(Full Changelog)

v0.82.0

Compare Source

Added Features

• performance: only check for a new DB once every 2 hours (configurable) [#​2148 @​wagoodman]
• wordpress-plugin support [#​1553 @​disc]

Bug Fixes

• use fix info from secDB in APK matcher even if NVD fix info present [#​2162 @​willmurphyscode]

Breaking Changes

• Split v1-5 DB distribution concerns to a new legacy package [#​2124 #​2144 @​wagoodman]

Additional Changes

• Add a space following the "Name:" label in html.tmpl [#​2155 @​deftdawg]

(Full Changelog)

v0.81.0

Compare Source

Added Features

• add distro mapping for azure linux 3 [#​1848 @​willmurphyscode]
• Support for Azure Linux 3.0 [#​1829]

(Full Changelog)

v0.80.2

Compare Source

Bug Fixes

• find secdb entries for origin packages [#​1602 @​luhring]
• Matching java binary packages with NVD records is problematic [#​1718 #​2114 @​wagoodman]
• LoadVulnerabilityDB could be faster with ValidateByHashOnGet [#​1502 #​2054 @​lucasrod16]

Additional Changes

• update Syft to v1.13.0 [#​2140 @​anchore-actions-token-generator]
• include file specifier in help [#​2121 @​willmurphyscode]

(Full Changelog)

v0.80.1

Compare Source

Bug Fixes

• CVE-2024-3154 found with latest version [#​1834 #​2091 @​spiffcs]

Additional Changes

• Update Syft to 1.12.2 [#​2108]

(Full Changelog)

v0.80.0

Compare Source

Added Features

• Add info subcommand in order to query grype db vulnerabilities [#​1629 #​2031 @​tomersein]

Bug Fixes

• correctly close the db file in v4/v5 stores [#​2066 @​AndreiStefanie]
• Grype panics with a nil pointer dereference error when given an empty string argument [#​2063 #​2064 @​lucasrod16]
• Ignoring search results when CPE is not set in the SBOM [#​2039 #​2040 @​aeg]
• "No vulnerability database update available" when actually the check for an update was unsuccessful [#​310 #​1247 @​shanedell]
• CycloneDX output metadata.properties set to null instead of empty array or omitted [#​1759]

Additional Changes

• update Syft to v1.11.1 [#​2071 @​anchore-actions-token-generator]
• add grype version to db network operations [#​2062 @​kzantow]

(Full Changelog)

v0.79.6

Compare Source

Bug Fixes

• Failed to parse constraint of CVE-2024-6345 which fails the scan [#​2048 #​2049 @​wagoodman]

(Full Changelog)

v0.79.5

Compare Source

Bug Fixes

• Grype failed to load vulnerability database: database metadata not found [#​1885 #​2033 @​willmurphyscode]

Additional Changes

• update to Syft 1.11.0 [#​2047 @​kzantow]
• add grype version to application update check headers [#​2021 @​kzantow]

(Full Changelog)

v0.79.4

Compare Source

Bug Fixes

• Disable ui before run function on db status [#​2008 @​wagoodman]

Additional Changes

• update Syft to v1.10.0 [#​2019 @​anchore-actions-token-generator]

(Full Changelog)

v0.79.3

Compare Source

Bug Fixes

• correct logic checking cpe target software component against package type [#​1658 @​westonsteimel]

Additional Changes

• update Syft to v1.9.0 [#​1986 @​anchore-actions-token-generator]

(Full Changelog)

v0.79.2

Compare Source

Bug Fixes

• use location RealPath not String() for match sorting [#​1950 @​luhring]

(Full Changelog)

v0.79.1

Compare Source

Updates

• update CI to install golang at the latest version [#​1949 @​spiffcs]
• Grype is now built with the latest version of Golang at v1.22.x. This resolves a few security findings that would have been flagged against the v0.79.0 binary for using an older version of the Golang standard library.

(Full Changelog)

v0.79.0

Compare Source

Added Features

• Installation script: Support checksum signature verification [#​1627 #​1670 @​hibare]

Bug Fixes

• fix match sort ordering for different locations [#​1944 @​luhring]
• Sort order for matches should consider fix info [#​1933 @​wagoodman]
• Go main module pseudo version matching: turn off by default [#​1894 @​luhring]
• Inconsistent naming of matchDetails.searchedBy.package field [#​1877 #​1900 @​kzantow]

(Full Changelog)

v0.78.0

Compare Source

Added Features

• add config command [#​1876 @​kzantow]

Bug Fixes

• ask catalog for package, rather than type asserting [#​1857 @​willmurphyscode]
• Disable TUI for simple commands [#​1872 @​wagoodman]
• False Positive: CVE-2023-42282 not affected in SUSE ecosystem [#​1813]
• False positive GHSA-jr9c-h74f-2v28/CVE-2022-0905 reported for Non-vulnerable Gitea version [#​1416]

Additional Changes

• Update syft to v1.5.0 [#​1897 @​wagoodman]

(Full Changelog)

v0.77.4

Compare Source

Additional Changes

• update Syft to v1.4.1 [#​1855 @​anchore-actions-token-generator]

(Full Changelog)

v0.77.3

Compare Source

Additional Changes

• Remove providers' pull information from DB metadata file [#​1846 @​asomya]

(Full Changelog)

v0.77.2

Compare Source

Bug Fixes

• update ignored vulnerability count in tui [#​1837 @​kzantow]
• SARIF output not compatible with GitHub [#​1518 #​1838 @​kzantow]

(Full Changelog)

v0.77.1

Compare Source

Additional Changes

• update Syft to v1.3.0 [#​1832 @​anchore-actions-token-generator]

(Full Changelog)

v0.77.0

Compare Source

Added Features

• add linux and libc-dev headers ignore rules for debian packages [#​1809 @​zhill]
• use Go main module version when possible [#​1797 @​luhring]

Additional Changes

• Add providers' pull date to DB metadata structure [#​1795 @​asomya]
• config: add config opt in golang pseudo version main module comparison [#​1816 @​spiffcs]

(Full Changelog)

v0.76.0

Compare Source

Added Features

• Database download timeouts [#​1731 #​1777 @​willmurphyscode]

Bug Fixes

• Disable matching kernel vulnerabilities by default for indirect matches against the 'kernel-headers' packages [#​1762 #​1787 @​zhill]

Additional Changes

• Update Syft to v1.2.0 [#​1803], which fixes https://github.com/anchore/grype/issues/1792

(Full Changelog)

v0.75.0

Compare Source

Added Features

• update syft source providers [#​1727 @​kzantow]
• enable http timeout [#​1777 @​willmurphyscode]

Bug Fixes

• use "path/filepath" to build file path [#​1767 @​seiyab]
• Suppress warnings when matching go packages with devel version [#​1752 @​wagoodman]
• not showing poco CVEs from syft generated sbom [#​1737]

(Full Changelog)

v0.74.7

Compare Source

Bug Fixes

• return exit codes from install script [#​1725 @​hacst]
• GitHub code scanning alerts missing information [#​1715 #​1720 @​kzantow]

Additional Changes

• update Syft to v0.105.1 [#​1728]

(Full Changelog)

gitea/helm-gitea (gitea)

v10.6.0

Compare Source

📢 This release unintentionally contains a breaking change which by default disables Gitea Actions. This feature should be enabled by default to match the vanilla Gitea experience. The issue is tracked as https://gitea.com/gitea/helm-chart/issues/731.

Features

• Add Gitea Actions act runner (#​666)
• Support custom envs for Action DinD container (#​722)

v10.5.0

Compare Source

Features

• Gitea 1.22.3 (#​718)
• feat(serviceMonitor): custom configuration (#​710)
• Add 'extraContainers' parameter (#​697)

Bug Fixes

• Fix namespace templating inconsistencies (#​713)
• Fix probe definition overrides (#​717)

Docs

• Add comments about redis password policy (#​706)
• Fix configuration in "external database" docs (#​716)

v10.4.1

Compare Source

Features

• Gitea 1.22.2

Bug Fixes

• Do not log errors in init-directories container during Gitea launch (#​708)
• Fix persistence for postgresql-ha (#​704)

Dependencies

• chore(deps): update subcharts (minor & patch) (#​695)
• chore(deps): update subcharts (minor & patch) (#​693)
• Improve Renovate behavior (#​689)

v10.4.0

Compare Source

Features

• Gitea 1.22.1 (#​684)
• feat: service.{http,ssh}.loadBalancerClass (#​640)

Dependencies

• chore(deps): update subcharts (minor & patch) (#​688)
• chore(deps): update alpine/helm docker tag to v3.15.3 (#​687)
• chore(deps): update postgresql docker tag to v15.5.16 (#​683)

v10.3.0

Compare Source

With v10.2.0, Gitea was bumped to 1.22.0. This update introduced a bug where the admin password had to be reset every time the Pod was recreated. To mitigate this issue, we decided to implement a feature that allows customization of this behavior (#​677) and also restores the behavior prior to Gitea 1.22.0. Hence, the double classification of #​677.

Features

• Add non-clustered redis as sub-chart (#​672)
• Enable admin user password creation/update mode in values (#​677) (#​673)

Bug Fixes

• Enable admin user password creation/update mode in values (#​677) (#​673)

Dependencies

• chore(deps): update subcharts (minor & patch) (#​680)
• chore(deps): update subcharts (minor & patch) (#​670)
• chore(deps): update subcharts (minor & patch) (#​669)
• chore(deps): update alpine/helm docker tag to v3.15.2 (#​668)
• chore(deps): update subcharts (minor & patch) (#​667)
• chore(deps): update subcharts (minor & patch) (#​665)

---

This tag has been re-tagged due to an expired gpg key for Helm signing. The original tagged commit is 1dbf171ad3566dc3cddd5aa74650708da0238d6e.

v10.2.0

Compare Source

• Bump Gitea to 1.22.0
• Add tpl support for PVC and ingress components (#​664)
• Quote image tag (#​641)
• Add deployment labels to deployment (#​649)

Subcharts

• Update PG to 15.5.0
• Update PG-HA to 14.1.3
• Update redis-cluster to 10.2.0

v10.1.4

Compare Source

• Bump Gitea to 1.21.11
• chore(deps): update postgresql-ha docker tag to v14.0.3 (#​639)
• chore(deps): update postgresql docker tag to v14 (#​622)
• chore(deps): update redis-cluster docker tag to v9.7.0 (#​621)

v10.1.3

Compare Source

• Bump Gitea to 1.21.7
• chore(deps): update workflow dependencies (minor & patch) (#​616)
• chore(deps): update redis-cluster docker tag to v9.6.2 (#​617)

v10.1.2

Compare Source

• Bump to Gitea 1.21.6
• Add tests for HA assertion and clean up (#​611)
• chore(deps): update subcharts (minor & patch) (#​613)

k3s-io/k3s (k3s-io/k3s)

v1.33.1+k3s1: v1.33.1+k3s1

Compare Source

This release updates Kubernetes to v1.33.1, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.33.0+k3s1:

• Backports for May (#​12319)
• Backports for 2025-05 (#​12325)
• Fix authorization-config/authentication-config handling (#​12344)
• Fix secretsencrypt race conditions (#​12355)
• Update to v1.33.1-k3s1 (#​12360)
• Fix startup e2e test (#​12370)

Embedded Component Versions

Component	Version
Kubernetes	v1.33.1
Kine	v0.13.15
SQLite	3.49.1
Etcd	v3.5.21-k3s1
Containerd	v2.0.5-k3s1
Runc	v1.2.6
Flannel	v0.26.7
Metrics-server	v0.7.2
Traefik	v3.3.6
CoreDNS	v1.12.1
Helm-controller	v0.16.10
Local-path-provisioner	v0.0.31

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.33.0+k3s1: v1.33.0+k3s1

Compare Source

This release updates Kubernetes to v1.33.0, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.32.4+k3s1

• Build k3s overhaul (#​12200)
• Fix sonobuoy conformance testing [(#​

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.