build(deps): Bump github.com/kubescape/storage from 0.0.185 to 0.2.0

[dependabot]

Bumps github.com/kubescape/storage from 0.0.185 to 0.2.0.

Release notes

Sourced from github.com/kubescape/storage's releases.

Release v0.0.263

Bumps github.com/cilium/cilium from 1.16.17 to 1.17.14.

... (truncated)

Commits

• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[kusari-inspector]

Kusari Analysis Results:

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

While the code analysis returned a clean result with zero vulnerabilities or secrets detected, the dependency analysis identified a critical blocking issue that must be resolved first. A high-severity container escape vulnerability (CVE-2025-52881) exists in the transitive dependency github.com/opencontainers/selinux v1.12.0, introduced via the chain: github.com/ossf/scorecard/v4 -> github.com/moby/buildkit -> github.com/opencontainers/selinux. This vulnerability allows an attacker to exploit arbitrary write gadgets and procfs write redirects in runc, potentially enabling full container breakout by misdirecting writes to dangerous files such as /proc/sysrq-trigger or /proc/sys/kernel/core_pattern. The CVSS impact scores are critically high across all vectors (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), representing a severe business risk for any containerized workload. The clean code analysis does not mitigate or invalidate this dependency risk, as the two analyses are independent. A fix path is available: update github.com/ossf/scorecard/v4 to its latest patched version and run go mod tidy to resolve the transitive dependency. This PR should not be merged until the vulnerable dependency is remediated.

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Dependency Mitigations

• CRITICAL - CVE-2025-52881 in github.com/opencontainers/selinux v1.12.0: This is a container escape and denial of service vulnerability caused by arbitrary write gadgets and procfs write redirects in runc. An attacker can trick runc into misdirecting writes to /proc, potentially writing to dangerous files like /proc/sysrq-trigger or /proc/sys/kernel/core_pattern, enabling full container breakout. Dependency path: github.com/ossf/scorecard/v4 -> github.com/moby/buildkit -> github.com/opencontainers/selinux (vulnerable). Fix: Update the root parent dependency github.com/ossf/scorecard/v4 to a version that pulls in a patched or removed version of github.com/opencontainers/selinux. The vulnerabilityFixReport confirms this is fixable via a parent update. Run: go get github.com/ossf/scorecard/v4@<latest-patched-version> and then go mod tidy to resolve the transitive dependency.

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: c44b5b7, performed at: 2026-04-01T14:39:43Z

Found this helpful? Give it a 👍 or 👎 reaction!

[stale]

This pull request has been automatically marked as stale because it has not had recent activity (60 days of inactivity).
It will be closed in 30 days if no further activity occurs.
Thank you for your contribution!

[mihaimaruseac]

@dependabot rebase

[kusari-inspector]

Kusari PR Analysis rerun based on - 1b297bf performed at: 2025-09-06T16:55:27Z - link to updated analysis

[mihaimaruseac]

@dependabot rebase

[kusari-inspector]

Kusari PR Analysis rerun based on - 6c672d3 performed at: 2025-09-17T16:15:34Z - link to updated analysis

[mihaimaruseac]

@dependabot rebase

[kusari-inspector]

Kusari PR Analysis rerun based on - 0878402 performed at: 2025-09-17T23:43:50Z - link to updated analysis

[mihaimaruseac]

@dependabot rebase

[mihaimaruseac]

@dependabot rebase

[mihaimaruseac]

@dependabot recreate

[mihaimaruseac]

@dependabot rebase

[mihaimaruseac]

@dependabot recreate

[mihaimaruseac]

@dependabot recreate

[mihaimaruseac]

@dependabot rebase

[mihaimaruseac]

@dependabot recreate

[mihaimaruseac]

@dependabot recreate

[kusari-inspector]

Kusari PR Analysis rerun based on - 6296b42 performed at: 2026-02-27T15:21:08Z - link to updated analysis

[mihaimaruseac]

@dependabot recreate

[kusari-inspector]

Kusari PR Analysis rerun based on - 47c156a performed at: 2026-02-27T15:29:51Z - link to updated analysis

[mihaimaruseac]

@dependabot recreate

[mihaimaruseac]

@dependabot recreate

[kusari-inspector]

Kusari PR Analysis rerun based on - c44b5b7 performed at: 2026-04-01T14:40:21Z - link to updated analysis

[gaganhr94]

kubescape 0.2.0 has some changes where the functions have been renamed. So this requires some manual work for the upgrade. I'll raise another PR for this