:seedling: Update Builder Image group by cluster-stack-bot[bot] · Pull Request #209 · SovereignCloudStack/csctl

cluster-stack-bot · 2026-01-01T11:26:26Z

This PR contains the following updates:

Package	Type	Update	Change
adrienverge/yamllint		minor	`v1.37.1` → `v1.38.0`
docker.io/aquasec/trivy (source)	stage	minor	`0.68.2` → `0.69.3`
docker.io/library/alpine	stage	patch	`3.23.0` → `3.23.3`
golangci/golangci-lint		minor	`v2.7.2` → `v2.11.1`

Release Notes

adrienverge/yamllint (adrienverge/yamllint)

`v1.38.0`

Compare Source

aquasecurity/trivy (docker.io/aquasec/trivy)

`v0.69.3`

Compare Source

Changelog

6fb20c8 release: v0.69.3 [release/v0.69] (#10293)
dabefec fix(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 [backport: release/v0.69] (#10291)

`v0.69.2`

Compare Source

Changelog

cfa322e release: v0.69.2 [release/v0.69] (#10266)
86debce fix(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 [backport: release/v0.69] (#10267)
cf3d4cd fix(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 [backport: release/v0.69] (#10264)
6dfd3b0 ci: remove apidiff workflow

`v0.69.1`

Compare Source

`v0.69.0`

Compare Source

⚠ BREAKING CHANGES

misconf: use ID instead of AVDID for providers mapping (#9752)

Features

activestate: add support ActiveState images (#10081) (676709d)
add AnalyzedBy field to track which analyzer detected packages (#10059) (1953824)
cloudformation: add support for Fn::ForEach (#9508) (d65b504)
debian: detect third-party packages using maintainer list (#9917) (effc1c0)
flag: add JSON Schema for trivy.yaml configuration file (#9971) (4caf731)
helm: add sslCertDir parameter (#9697) (879e4fc)
julia: enable vulnerability scanning for the Julia language ecosystem (#9800) (c2f82ad)
misconf: add action block to Terraform schema (#10035) (b06ef6d)
misconf: initial ansible scanning support (#9332) (9275e15)
misconf: support for ARM resources defined as an object (#9959) (92d3465)
misconf: support for azurerm_*_web_app (#9944) (37b5da8)
misconf: Update Azure Database schema (#9811) (48dfede)
misconf: use Terraform plan configuration to partially restore schema (#9623) (5fced3a)
nodejs: parse licenses from package-lock.json file (#9983) (b64d5ad)
php: add support for dev dependencies in Composer (#9910) (56b59e8)
report: add Trivy version to JSON output (#10065) (fe7d20a)
rocky: enable modular package vulnerability detection (#10069) (31c4780)
rootio: Update trivy db to support usage of Severity from root.io feed (#9930) (d3096e7)
sbom: exclude PEP 770 SBOMs in .dist-info/sboms/ (#10033) (07ff788)
secret: add detection for Symfony default secret key (#9892) (34baef2)
vex: support per-repo tls configuration (#10030) (f809066)
vuln: skip vulnerability scanning for third-party packages in Debian/Ubuntu (#9932) (74819bf)

Bug Fixes

docker: fix non-det scan results for images with embedded SBOM (#9866) (7f71b57)
go: use ldflags version for all pseudo-versions (#10037) (3c0ab97)
image: race condition in image artifact inspection (#9966) (18acf4f)
java: add hash of GAV+root pom file path for pkgID for packages from pom.xml files (#9880) (809db46)
java: correctly inherit properties from parent fields for pom.xml files (#9111) (2933b01)
java: correctly propagate repositories from upper POMs to dependencies (#10077) (b9415a3)
license: normalize licenses for PostAnalyzers (#9941) (11dd3fa)
misconf: correct typos in block and attribute names (#9993) (ac061f8)
misconf: respect .yml files when Helm charts are detected (#9912) (18ecf75)
misconf: safely parse rotation_period in google_kms_crypto_key (#9980) (a0ecc8e)
move enum into items for array-type fields in JSON Schema (#10039) (4e06c3d)
remove trailing tab in statefulset template (#9889) (9db123c)
repo: return a nil interface for gitAuth if missing (#10097) (036c05b)
rust: add cargo workspace members glob support (#10032) (d2dc46a)
rust: implement version inheritance for Cargo mono repos (#10011) (47d3103)
secret: improve word boundary detection for Hugging Face tokens (#10046) (cdb28ee)
use canonical SPDX license IDs from embeded licenses.json (#10053) (c233735)
vex: add CVE-2025-66564 as not_affected into Trivy VEX file (#9924) (335cc99)
vuln: skip vulns detection for CentOS Stream family without scan failure (#9964) (b46cde0)

Performance Improvements

misconf: optimize string concatenation in azure scanner (#9969) (10a50a7)

Code Refactoring

misconf: use ID instead of AVDID for providers mapping (#9752) (6462dc8)

golangci/golangci-lint (golangci/golangci-lint)

`v2.11.1`

Compare Source

Released on 2026-03-06

Due to an error related to AUR, some artifacts of the v2.11.0 release have not been published.

This release contains the same things as v2.11.0.

`v2.11.0`

Compare Source

Released on 2026-03-06

Linters new features or changes
- errcheck: from 1.9.0 to 1.10.0 (exclude crypto/rand.Read by default)
- gosec: from 2.23.0 to 2.24.6 (new rules: G113, G118, G119, G120, G121, G122, G123, G408, G707)
- noctx: from 0.4.0 to 0.5.0 (new detection: httptest.NewRequestWithContext)
- prealloc: from 1.0.2 to 1.1.0
- revive: from 1.14.0 to 1.15.0 (⚠️ Breaking change: package-related checks moved from var-naming to a new rule package-naming)
Linters bug fixes
- gocognit: from 1.2.0 to 1.2.1
- gosec: from 2.24.6 to 2.24.7
- unqueryvet: from 1.5.3 to 1.5.4

`v2.10.1`

Compare Source

Released on 2026-02-17

Fixes
- buildssa panic

`v2.10.0`

Compare Source

Released on 2026-02-17

Linters new features or changes
- ginkgolinter: from 0.22.0 to 0.23.0
- gosec: from 2.22.11 to 2.23.0 (new rules: G117, G602, G701, G702, G703, G704, G705, G706)
- staticcheck: from 0.6.1 to 0.7.0
Linters bug fixes
- godoclint: from 0.11.1 to 0.11.2

`v2.9.0`

Compare Source

Released on 2026-02-10

Enhancements
- 🎉 go1.26 support
Linters new features or changes
- arangolint: from 0.3.1 to 0.4.0 (new rule: detect potential query injections)
- ginkgolinter: from 0.21.2 to 0.22.0 (support for wrappers)
- golines: from 0.14.0 to 0.15.0
- misspell: from 0.7.0 to 0.8.0
- revive: from v1.13.0 to v1.14.0 (new rules: epoch-naming, use-slices-sort)
- unqueryvet: from 1.4.0 to 1.5.3 (new options: check-n1, check-sql-injection, check-tx-leaks, allow, custom-rules)
- wsl_v5: from 5.3.0 to 5.6.0 (new rule: after-block)
Linters bug fixes
- modernize: from 0.41.0 to 0.42.0
- prealloc: from 1.0.1 to 1.0.2
- protogetter: from 0.3.18 to 0.3.20
Misc.
- Log information about files when configuration verification
- Emit an error when no linters enabled
- Do not collect VCS information when loading code

`v2.8.0`

Compare Source

Released on 2026-01-07

Linters new features or changes
- godoclint: from 0.10.2 to 0.11.1 (new rule: require-stdlib-doclink)
- golines: from 442fd00 to 0.14.0
- gomoddirectives: from 0.7.1 to 0.8.0
- gosec: from daccba6 to 2.22.11 (new rule: G116)
- modernize: from 0.39.0 to 0.40.0 (new analyzers: stringscut, unsafefuncs)
- prealloc: from 1.0.0 to 1.0.1 (message changes)
- unqueryvet: from 1.3.0 to 1.4.0 (new options: check-aliased-wildcard, check-string-concat, check-format-strings, check-string-builder, check-subqueries, ignored-functions, sql-builders)
Linters bug fixes
- gocritic: from 0.14.2 to 0.14.3
- errorlint: from 1.8.0 to 1.9.0
- govet: from 0.39.0 to 0.40.0
- protogetter: from 0.3.17 to 0.3.18
- revive: add missing enable-default-rules setting
Documentation
- docs: split installation page

Configuration

📅 Schedule: Branch creation - "on the first day of the month" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

cluster-stack-bot · 2026-01-13T11:29:25Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Command failed: /bin/sh -c BUILD_IMAGE_TOKEN=**redacted** BUILD_IMAGE_USER=janiskemper CI=true ./hack/upgrade-builder-image.sh
+ git diff --exit-code .builder-image-version.txt images/builder/Dockerfile images/builder/build.sh
+ '[' true = true ']'
+ echo **redacted**
+ docker login ghcr.io -u janiskemper --password-stdin

WARNING! Your credentials are stored unencrypted in '/home/ubuntu/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/

++ git fetch --quiet origin main
++ git show origin/main:.builder-image-version.txt
+ VERSION=0.2.3
+ '[' -z 0.2.3 ']'
+ export VERSION
++ semver_upgrade patch 0.2.3
++ IFS=.
++ read -r version minor patch
++ case "$1" in
++ tag=0.2.4
++ echo 0.2.4
+ NEW_VERSION=0.2.4
+ export NEW_VERSION
+ docker manifest inspect ghcr.io/sovereigncloudstack/csctl-builder:0.2.3
+ echo 0.2.4
+ echo 'Wrote new version 0.2.4 to .builder-image-version.txt'
+ docker manifest inspect ghcr.io/sovereigncloudstack/csctl-builder:0.2.4
+ echo 0
+ sed -i -e '/^BUILDER_IMAGE_VERSION /s/:=.*$/:= 0.2.4/' Makefile
+ grep -r -E 'ghcr.io/sovereigncloudstack/csctl-builder:[0-9].*.*' -l
+ xargs sed -i -e 's/ghcr.io\/sovereigncloudstack\/csctl-builder:0.2.3/ghcr.io\/sovereigncloudstack\/csctl-builder:0.2.4/g'
+ docker build -t ghcr.io/sovereigncloudstack/csctl-builder:0.2.4 ./images/builder
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
            Install the buildx component to build images with BuildKit:
            https://docs.docker.com/go/buildx/

The command '/bin/sh -c apt-get update &&   apt-get install -qy --no-install-recommends   gnupg python3 python3-pip   file zip unzip jq gettext   skopeo=${SKOPEO_VERSION}   protobuf-compiler libprotobuf-dev   libsystemd-dev jq &&   rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* &&   pip install --no-cache-dir   yamllint==${YAMLLINT_VERSION}   yamlfixer-opt-nc==${YAMLFIXER_VERSION}' returned a non-zero code: 1

| datasource | package | from | to | | ----------- | ------------------------ | ------- | ------- | | github-tags | adrienverge/yamllint | v1.37.1 | v1.38.0 | | docker | docker.io/aquasec/trivy | 0.68.2 | 0.69.3 | | docker | docker.io/library/alpine | 3.23.0 | 3.23.3 | | github-tags | golangci/golangci-lint | v2.7.2 | v2.11.1 |

cluster-stack-bot bot added type/patch update/container size/XS Denotes a PR that changes 0-20 lines, ignoring generated files. labels Jan 1, 2026

cluster-stack-bot bot changed the title ~~🌱 Update Builder Image group to v3.23.2~~ 🌱 Update Builder Image group Jan 8, 2026

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch from 882be23 to 3153fe8 Compare January 8, 2026 11:29

cluster-stack-bot bot added the area/github Changes made in the github directory label Jan 8, 2026

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch from 3153fe8 to 9614e4a Compare January 13, 2026 11:29

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch 2 times, most recently from fd1175f to 8ea7a3c Compare January 30, 2026 11:37

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch 2 times, most recently from 2c00bf2 to 5504508 Compare February 11, 2026 11:52

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch from 5504508 to ea9ce6e Compare February 18, 2026 11:46

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch 2 times, most recently from 8b67bce to 5c24a1b Compare March 4, 2026 11:39

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch from 5c24a1b to 97f3db1 Compare March 7, 2026 11:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🌱 Update Builder Image group#209

🌱 Update Builder Image group#209
cluster-stack-bot[bot] wants to merge 1 commit intomainfrom
renovate/csctl-builder-image

cluster-stack-bot bot commented Jan 1, 2026 •

edited

Loading

Uh oh!

cluster-stack-bot bot commented Jan 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

cluster-stack-bot bot commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Changelog

Changelog

⚠ BREAKING CHANGES

Features

Bug Fixes

Performance Improvements

Code Refactoring

Configuration

Uh oh!

cluster-stack-bot bot commented Jan 13, 2026

⚠️ Artifact update problem

File name: undefined

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

cluster-stack-bot bot commented Jan 1, 2026 •

edited

Loading