chore(deps): update vendir to v0.45.3

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
vendir	patch	0.45.2 → 0.45.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

carvel-dev/vendir (vendir)

v0.45.3

Compare Source

Installation and signature verification

Installation

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.45.3/vendir-linux-amd64

# Move the binary in to your PATH
mv vendir-linux-amd64 /usr/local/bin/vendir

# Make the binary executable
chmod +x /usr/local/bin/vendir

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install vendir
$ vendir version  

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.45.3/checksums.txt
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.45.3/checksums.txt.pem
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.45.3/checksums.txt.sig

# Verify the checksums file
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp=https://github.com/carvel-dev \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature.

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

What's Changed

• Update carvel-dev/semver to include stability-aware sorting fixes by @​sameerforhttps://github.com/carvel-dev/vendir/pull/445ll/445

Full Changelog: carvel-dev/vendir@v0.45.2...v0.45.3

📂 Files Checksum

4c27422b42a83ed598e5548542c0cd19d185002f6d4ae8e12d59df27ebcdf572  ./vendir-darwin-arm64
cb951dedcf2e64d8d76cb9c205d13ce78f6a8802a74caa1205ec47bc9f2dac65  ./vendir-linux-arm64
52a584cf8c9c97b0f9693f33e404b971f3f65bff3a136d979d7b92c8a8f5cf62  ./vendir-darwin-amd64
5d73e1c1eccf245585887c99ebe004712adfaa5db66b212066df37b572475fca  ./vendir-windows-amd64.exe
7dc6dd9706170b442a7aaf3b4e29da57cca722a3252ed8f6ac9c2997e93a0aa5  ./vendir-linux-amd64

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/vendir:0.45.3

📦 Image Reference ghcr.io/uniget-org/tools/vendir:0.45.3

digest	sha256:6750c23eb8f0f5b0bee1b59c0eefb2e14affc848a0dc55eb11cc06fd0e3b4c13
vulnerabilities
platform	linux/amd64
size	13 MB
packages	98

stdlib 1.25.7 (golang) pkg:golang/stdlib@1.25.7 Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.021% EPSS Percentile 6th percentile Description If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.021% EPSS Percentile 5th percentile Description Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.021% EPSS Percentile 5th percentile Description During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.033% EPSS Percentile 10th percentile Description url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.008% EPSS Percentile 1st percentile Description On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.014% EPSS Percentile 3rd percentile Description Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.012% EPSS Percentile 2nd percentile Description Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.006% EPSS Percentile 0th percentile Description tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.005% EPSS Percentile 0th percentile Description On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

github.com/docker/cli 28.2.2+incompatible (golang) pkg:golang/github.com/docker/cli@28.2.2%2Bincompatible Uncontrolled Search Path Element Affected range >=19.03.0 <29.2.0 Fixed version 29.2.0 CVSS Score 7 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.023% EPSS Percentile 6th percentile Description This issue affects Docker CLI through 29.1.5 Impact Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI through v29.1.5 (fixed in v29.2.0). It impacts Windows binaries acting as a CLI plugin manager via the [github.com/docker/cli/cli-plugins/manager](https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager) package, which is consumed by downstream projects such as Docker Compose. Docker Compose became affected starting in v2.31.0, when it incorporated the relevant CLI plugin manager code (see docker/compose#12300), and is fixed in v5.1.0. This issue does not impact non-Windows binaries or projects that do not use the plugin manager code. Patches Fixed version starts with 29.2.0 This issue was fixed in docker/cli@1375933 (docker/cli#6713), which removed %PROGRAMDATA%\Docker\cli-plugins from the list of paths used for plugin-discovery on Windows. Workarounds None Resources Pull request: "cli-plugins/manager: remove legacy system-wide cli-plugin path" (cli-plugins/manager: remove legacy system-wide cli-plugin path docker/cli#6713) Patch: https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa.patch Credits Nitesh Surana (niteshsurana.com) of Trend Research of TrendAI

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/24503750975.

[github-actions]

PR is blocked and cannot be merged. See https://github.com/uniget-org/tools/actions/runs/24503750975.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.