Skip to content

fixed grpc vuln - #716

Closed
zackbradys wants to merge 23 commits into
mainfrom
fixed-grpc-vuln
Closed

fixed grpc vuln#716
zackbradys wants to merge 23 commits into
mainfrom
fixed-grpc-vuln

Conversation

@zackbradys

@zackbradys zackbradys commented Aug 7, 2026

Copy link
Copy Markdown
Member

Please check below, if the PR fulfills these requirements:

  • Commit(s) and code follow the repositories guidelines.
  • Test(s) have been added or updated to support these change(s).
  • Doc(s) have been added or updated to support these change(s).

Associated Links:

  • N/A

Types of Changes:

  • Vulnerability Fix

Proposed Changes:

Verification/Testing of Changes:

  • N/A

Additional Context:

  • N/A

mergify Bot and others added 23 commits July 9, 2026 09:55
@mergify @amartin120
add trivy to make and add new vuln GHA (backport #641) (#651)
25f7185 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @amartin120
digest only regression fix (backport #643) (#652)
6f6a101 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @zackbradys
unpinned distribution/distribution dependency (backport #647) (#653)
777d0f0 
Co-authored-by: Zack Brady <zackbrady123@gmail.com>
@mergify @amartin120
updates for helm v4 (backport #648) (#654)
a3543f6 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @eklatzer @zackbradys
feat: extend charts resource with helm values (backport #644) (#655)
581ea4c 
Signed-off-by: Zack Brady <zackbrady123@gmail.com>
Co-authored-by: Eric Klatzer <eric@klatzer.at>
Co-authored-by: Zack Brady <zackbrady123@gmail.com>
@mergify @dependabot
bump golang.org/x/sync from 0.21.0 to 0.22.0 (backport #650) (#656)
bf88ce6 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @dependabot
bump github.com/containerd/containerd from 1.7.33 to 1.7.34 (backport #…
decf7ed 
…659) (#664)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @dependabot
bump helm.sh/helm/v4 from 4.2.2 to 4.2.3 (backport #661) (#665)
fcf53f0 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @amartin120
utilize vex for trivy scan (backport #662) (#666)
22b14c9 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @amartin120
fix the broken behavior for --insecure on copy (backport #668) (#669)
16076a1 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @amartin120
bump containerd to v2 (backport #663) (#670)
cb324cc 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @dependabot
Bump github.com/sigstore/cosign/v3 from 3.1.1 to 3.1.2 (backport #674) (
494b62b 
#679)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @hierynomus @amartin120
fix: plain-http enforces use of http on bearer token fetch (#677) (ba…
2c4b798 
…ckport #678) (#680)

Co-authored-by: Jeroen van Erp <jeroen@hierynomus.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @amartin120
fix for copying digest artifacts (backport #673) (#683)
43e361d 
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @amartin120
registry auth fallback bugfix (backport #672) (#684)
13512a3 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @amartin120
fix: bump golang to 1.26.5 (backport #685) (#686)
4ece589 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @dependabot
Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport #688) (#692)
cfd476c 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @dependabot
Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the go_modules group…
a6f031f 
… across 1 directory (backport #691) (#693)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @amartin120
fix for homebrew macOS binary quarantine (backport #690) (#696)
d7d129a 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
Co-authored-by: Adam Martin <adam.martin@ranchergovernment.com>
@mergify @aeltai
fix: process helm deps before --add-images discovery (backport #703) (#…
2475087 
…704)

Co-authored-by: aeltai <ala.eltai@suse.com>
@amartin120
address helm chart verification, auth, and tls options (#601)
f190939 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
(cherry picked from commit 2e280f2)
@mergify @CamrynCarter
update hauler store remove to handle registry reference as part of st…
1136f3d 
…ring (backport #705) (#706)

Signed-off-by: Camryn Carter <camryn.carter@ranchergovernment.com>
Co-authored-by: Camryn Carter <camryn.carter@ranchergovernment.com>
@zackbradys
fixed vuln for golang grpc
dd24b75
@github-project-automation github-project-automation Bot moved this to To Triage in Hauler Aug 7, 2026
@zackbradys zackbradys closed this Aug 7, 2026
@github-project-automation github-project-automation Bot moved this from To Triage to Resolved in Hauler Aug 7, 2026
@zackbradys
zackbradys deleted the fixed-grpc-vuln branch August 7, 2026 15:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

Hauler
Status: Resolved

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@zackbradys @amartin120