Skip to content

Commit 2d802b4

Browse files
authored
Merge branch 'main' into feat/bump-deps-logstash91-20251009
2 parents 6ef43a0 + efc9901 commit 2d802b4

16 files changed

Lines changed: 136 additions & 53 deletions
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
issuer: https://accounts.google.com
2+
3+
# Dev service account for testing
4+
# - cve-detection-sa@jml-test-chainguard-dev.iam.gserviceaccount.com 117144291088285847777
5+
subject_pattern: "117144291088285847777"
6+
7+
# Allow CVE detection automation to use Melange package information.
8+
permissions:
9+
contents: read

R-units.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package:
22
name: R-units
3-
version: "0.8.7"
4-
epoch: 1
3+
version: "1.0.0"
4+
epoch: 0
55
description: Measurement Units for R Vectors
66
copyright:
77
- license: GPL-2.0-or-later
@@ -31,7 +31,7 @@ pipeline:
3131
with:
3232
repository: https://github.com/cran/units
3333
tag: ${{vars.mangled-package-version}}
34-
expected-commit: c26f6d1f3910716b3fae684c4022ce3f59c945ab
34+
expected-commit: ad0d0bd4aa16581840121386bf796f51a140462c
3535

3636
- uses: R/build
3737
with:

envoy-gateway.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package:
22
name: envoy-gateway
3-
version: "1.5.2"
3+
version: "1.5.3"
44
epoch: 0 # GHSA-jc7w-c686-c4v9
55
description: Manages Envoy Proxy as a Standalone or Kubernetes-based Application Gateway
66
copyright:
@@ -14,7 +14,7 @@ environment:
1414
pipeline:
1515
- uses: git-checkout
1616
with:
17-
expected-commit: d0a2d3d4dcf41a1b5c1de0e1729b51b8d5cfe180
17+
expected-commit: 25d158912b9474b04ab9737be6c67eb5dc9c95e0
1818
repository: https://github.com/envoyproxy/gateway
1919
tag: v${{package.version}}
2020

flannel.yaml

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package:
22
name: flannel
3-
version: "0.27.3"
4-
epoch: 0 # CVE-2025-47907
3+
version: "0.27.4"
4+
epoch: 1 # CVE-2025-47907
55
description: flannel is a network fabric for containers, designed for Kubernetes
66
copyright:
77
- license: Apache-2.0
@@ -29,7 +29,12 @@ pipeline:
2929
with:
3030
repository: https://github.com/flannel-io/flannel
3131
tag: v${{package.version}}
32-
expected-commit: b243632fbf70280bc46b949d9ea5ace5d91ef105
32+
expected-commit: 20bdda0b238784fbfa623a1cf4c469645f531efa
33+
34+
- if: ${{build.arch}} == 'aarch64'
35+
uses: patch
36+
with:
37+
patches: disableBrNetfilterCheck.patch
3338

3439
- uses: go/build
3540
with:
@@ -112,8 +117,13 @@ test:
112117
sleep 3
113118
114119
# Run flanneld in background
115-
flanneld --etcd-endpoints=$ETCD_ENDPOINTS --iface=$IFACE --iptables-forward-rules=false > /tmp/flannel.log 2>&1 &
116-
FLANNEL_PID=$!
120+
if [ "${{build.arch}}" = "aarch64" ]; then
121+
flanneld --etcd-endpoints=$ETCD_ENDPOINTS --iface=$IFACE --iptables-forward-rules=false --disable-br-netfilter-check > /tmp/flannel.log 2>&1 &
122+
FLANNEL_PID=$!
123+
else
124+
flanneld --etcd-endpoints=$ETCD_ENDPOINTS --iface=$IFACE --iptables-forward-rules=false > /tmp/flannel.log 2>&1 &
125+
FLANNEL_PID=$!
126+
fi
117127
118128
# Save PID to environment file
119129
echo "export FLANNEL_PID=$FLANNEL_PID" >> /tmp/env.sh
Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From b1b4adec167ad515754061b27428449d3c9a39de Mon Sep 17 00:00:00 2001
2+
From: Debasish Biswas <debasishbsws.dev@gmail.com>
3+
Date: Thu, 9 Oct 2025 08:41:15 +0000
4+
Subject: [PATCH] feat: add --disable-br-netfilter-check flag for container
5+
environments
6+
7+
This change adds a new command-line flag --disable-br-netfilter-check to address
8+
compatibility issues in containerized environments, particularly for CI/CD pipelines test
9+
using Docker runners on aarch64 architecture.
10+
11+
Signed-off-by: Debasish Biswas <debasishbsws.dev@gmail.com>
12+
---
13+
main.go | 4 +++-
14+
1 file changed, 3 insertions(+), 1 deletion(-)
15+
16+
diff --git a/main.go b/main.go
17+
index 6f40c4d2..d29ac68b 100644
18+
--- a/main.go
19+
+++ b/main.go
20+
@@ -98,6 +98,7 @@ type CmdLineOpts struct {
21+
blackholeRoute bool
22+
netConfPath string
23+
setNodeNetworkUnavailable bool
24+
+ disableBrNetfilterCheck bool
25+
}
26+
27+
var (
28+
@@ -136,6 +137,7 @@ func init() {
29+
flannelFlags.BoolVar(&opts.blackholeRoute, "ip-blackhole-route", false, "add blackroute route ont the node for the local podCIDR")
30+
flannelFlags.StringVar(&opts.netConfPath, "net-config-path", "/etc/kube-flannel/net-conf.json", "path to the network configuration file")
31+
flannelFlags.BoolVar(&opts.setNodeNetworkUnavailable, "set-node-network-unavailable", true, "set NodeNetworkUnavailable after ready")
32+
+ flannelFlags.BoolVar(&opts.disableBrNetfilterCheck, "disable-br-netfilter-check", false, "disable br_netfilter module check (useful for Docker environments)")
33+
34+
log.InitFlags(nil)
35+
36+
@@ -271,7 +273,7 @@ func main() {
37+
os.Exit(1)
38+
}
39+
40+
- if runtime.GOOS != "windows" {
41+
+ if runtime.GOOS != "windows" && !opts.disableBrNetfilterCheck {
42+
// From Kubernetes 1.30 kubeadm doesn't check if the br_netfilter module is loaded and in case it's missing Flannel wrongly starts
43+
if config.EnableIPv4 {
44+
if _, err = os.Stat("/proc/sys/net/bridge/bridge-nf-call-iptables"); os.IsNotExist(err) {
45+
--
46+
2.51.0
47+

flyway.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package:
22
name: flyway
3-
version: "11.13.3"
3+
version: "11.14.0"
44
epoch: 0
55
description: "Flyway is a database migration tool to evolve your database schema easily and reliably across all your instances."
66
copyright:
@@ -37,7 +37,7 @@ pipeline:
3737
with:
3838
repository: https://github.com/flyway/flyway
3939
tag: flyway-${{package.version}}
40-
expected-commit: c3e305df5c3473c77a78ea1bb21d97fe5080cfa0
40+
expected-commit: 796bc3217a99012e51f5c666a3cbdd6c6ccc6dcb
4141

4242
- uses: maven/pombump
4343
with:

grafana-alloy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package:
22
name: grafana-alloy
3-
version: "1.11.0"
3+
version: "1.11.1"
44
epoch: 0 # CVE-2025-47910
55
description: OpenTelemetry Collector distribution with programmable pipelines
66
copyright:
@@ -31,7 +31,7 @@ pipeline:
3131
with:
3232
repository: https://github.com/grafana/alloy
3333
tag: v${{package.version}}
34-
expected-commit: 7bd7f7f9a3e8262ae54c2bb4ccc491ae1d7f480e
34+
expected-commit: eebd2307a1fa819556f0591f71b39ec1decdd7b3
3535

3636
- name: Generate UI
3737
runs: make generate-ui

grafana-image-renderer.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package:
22
name: grafana-image-renderer
3-
version: "4.0.16"
3+
version: "4.0.17"
44
epoch: 0 # GHSA-vj76-c3g6-qr5v
55
description: A Grafana backend plugin that handles rendering of panels & dashboards to PNGs using headless browser (Chromium/Chrome)
66
copyright:
@@ -32,7 +32,7 @@ pipeline:
3232
with:
3333
repository: https://github.com/grafana/grafana-image-renderer
3434
tag: v${{package.version}}
35-
expected-commit: 3998b13834d08065b507e48ae3af9aadfa85dee9
35+
expected-commit: 1858c2c51347b23f43b1d288bc9222f16030e3f9
3636

3737
- uses: patch
3838
with:

jitsucom-jitsu.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package:
22
name: jitsucom-jitsu
33
version: "2.11.0"
4-
epoch: 3 # GHSA-33vc-wfww-vjfv
4+
epoch: 4 # GHSA-mm7p-fcc7-pg87
55
description: Jitsu is an open-source Segment alternative. Fully-scriptable data ingestion engine for modern data teams. Set-up a real-time data pipeline in minutes, not days
66
copyright:
77
- license: MIT
Lines changed: 3 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,8 @@
1-
From 34a809ac6aca7f8c190c36de1a05a230101a2509 Mon Sep 17 00:00:00 2001
2-
From: Kyle Steere <kyle.steere@chainguard.dev>
3-
Date: Thu, 5 Jun 2025 20:29:20 -0500
4-
Subject: [PATCH] consolidated cve remedation patches: CVE-2025-48387
5-
CVE-2025-22150 CVE-2025-27152 CVE-2025-27789 CVE-2024-53382 GHSA-fjxv-7rqg-78g4
6-
GHSA-xv57-4mr9-wg8v GHSA-g5qg-72qw-gw5v GHSA-4342-x723-ch2f
7-
8-
Signed-off-by: Kyle Steere <kyle.steere@chainguard.dev>
9-
---
10-
package.json | 9 ++++++++-
11-
1 file changed, 8 insertions(+), 1 deletion(-)
12-
131
diff --git a/package.json b/package.json
14-
index a63735238..f631cd555 100644
2+
index 061b7fefd..c9cbffdc7 100644
153
--- a/package.json
164
+++ b/package.json
17-
@@ -66,5 +66,14 @@
5+
@@ -86,5 +86,15 @@
186
"services/*",
197
"cli/*",
208
"libs/*"
@@ -27,8 +15,7 @@ index a63735238..f631cd555 100644
2715
+ "tar-fs": "^2.1.3",
2816
+ "prismjs": "^1.30.0",
2917
+ "form-data": "^4.0.4",
18+
+ "nodemailer": "^7.0.7",
3019
+ "next": "^15.4.7"
3120
+ }
3221
}
33-
--
34-
2.43.0

0 commit comments

Comments
 (0)