chore(deps): update tools

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending	Age	Adoption	Passing	Confidence
aquasecurity/trivy	minor	v0.74.0 → v0.75.0
github.com/anchore/syft	minor	v1.52.0 → v1.54.0
helm-unittest/helm-unittest	minor	v1.1.2 → v1.2.0	v1.2.1
k8s.io/kube-openapi	patch	v0.0.0-20260911184034-7970a1e230da → v0.0.0-20261001230523-97fa35140926

---

Release Notes

aquasecurity/trivy (aquasecurity/trivy)

v0.75.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/11333

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0750-2026-10-01

anchore/syft (github.com/anchore/syft)

v1.54.0

Compare Source

Added Features

• report the perl interpreter as a cpan package [PR #​5132 @​wagoodman]
• Add package cataloger for perl ecosystem [Issue #​1906] [PR #​5131 @​wagoodman]
• Analyze with Non-Daemon podman [Issue #​1173]

Bug Fixes

• write a name for the root package when the source has none [PR #​5349 @​DrVelvetFog]
• match opensource.org license URLs across SPDX URL forms [PR #​5361 @​willmurphyscode]
• Account for malformed GGUF and safetensors parameter counts [PR #​5343 @​wagoodman]
• don't panic on a root file without a supplier or null entries [PR #​5326 @​DrVelvetFog]
• do not panic on a stack.yaml rev pin [PR #​5310 @​arpitjain099]
• report scanner errors and raise the line cap in metadata parsers [PR #​5353 @​wagoodman]
• Harden cataloger parsers against truncated input (do not panic) [PR #​5355 @​wagoodman]
• bound CPE candidate generation for pathological package metadata [PR #​5356 @​wagoodman]
• account for UPX's loader padding when unpacking Go binaries [PR #​5347 @​huuyafwww]
• handle malformed GGUF headers without panicking [PR #​5345 @​wagoodman]
• bound model companion file reads and validate their contents [PR #​5344 @​wagoodman]
• don't fail the whole SBOM when a cataloger panics on one file [PR #​5342 @​wagoodman]
• release package collection lock in Ubuntu ESM detection [PR #​5336 @​sverrirsig]
• render TUI log lines on their own rows, with colors and a small header [PR #​5324 @​wagoodman]
• uv.lock: dependents are linked to every locked version of a dependency [Issue #​5340] [PR #​5351 @​devtechedge]
• java-archive-cataloger maps Apache Groovy 4+ (org.apache.groovy) to obsolete org.codehaus.groovy [Issue #​5311] [PR #​5313 @​texasich]
• Support traefik binary various versions [Issue #​4980] [PR #​5281 @​mayanksekhar]
• File Digests Remain at Zero, No Hashes Available Despite .syft.yaml Settings Should Support [Issue #​5325] [PR #​5341 @​wagoodman]
• not showing expat CVEs from syft generated sbom [Issue #​4771] [PR #​5259 @​KR-Ravindra]
• PHP extensions are cataloged as upstream products using the PHP version [Issue #​5014] [PR #​5102 @​pujitha24]
• Panic during scanning with gguf-cataloger/safetensors-cataloger [Issue #​5327] [PR #​5328 @​tk1475]
• github-actions cataloger emits an invalid PURL for docker:// use statements [Issue #​5299] [PR #​5302 @​yunaremaia]
• Crash when running syft on a directory that is the root file system of a Yocto build [Issue #​5320] [PR #​5321 @​somaz94]
• Invalid PURLs when cataloging instrumentation classes/jars [Issue #​2596]

Dependencies

79 dependency changes (48 updated, 28 added, 3 removed). 2 vulnerabilities remediated.

🟢 Remediated (2)

• GHSA-8wmf-6v46-5gfg (Low) — go.opentelemetry.io/otel/sdk
• GHSA-pg57-6jwg-q645 (Medium) — github.com/containerd/containerd/v2

Toolchains (1)

• Go minimum version: 1.26.3 → 1.26.8

Updated (48 packages)

• github.com/Microsoft/hcsshim v0.15.0-rc.1 → v0.15.0-rc.4
• github.com/anchore/bubbly v0.2.1 → v0.2.2
• github.com/anchore/go-logger v0.1.1 → v0.2.0
• github.com/anchore/stereoscope v0.3.2 → v0.3.3
• github.com/bmatcuk/doublestar/v4 v4.10.0 → v4.10.2
• github.com/containerd/containerd/api v1.11.1 → v1.12.0
• github.com/containerd/containerd/v2 v2.3.5 → v2.4.1 (🟢 remediated GHSA-pg57-6jwg-q645)
• github.com/containerd/log v0.1.0 → v0.2.0
• github.com/containerd/ttrpc v1.2.8 → v1.2.9
• github.com/containerd/typeurl/v2 v2.2.3 → v2.3.0
• github.com/cyphar/filepath-securejoin v0.6.1 → v0.7.0
• github.com/docker/cli v29.8.0+incompatible → v29.8.1+incompatible
• github.com/docker/docker-credential-helpers v0.9.5 → v0.9.8
• github.com/dustin/go-humanize v1.0.1 → v1.1.0
• github.com/erofs/go-erofs v0.3.0 → v0.3.1
• github.com/felixge/httpsnoop v1.0.4 → v1.1.0
• github.com/fsnotify/fsnotify v1.9.0 → v1.10.1
• github.com/go-jose/go-jose/v4 v4.1.4 → v4.1.5
• github.com/go-logr/logr v1.4.3 → v1.4.4
• github.com/hashicorp/hcl/v2 v2.24.0 → v2.25.0
• github.com/magiconair/properties v1.18.11 → v1.18.12
• github.com/mattn/go-runewidth v0.0.21 → v0.0.27
• github.com/moby/sys/user v0.4.0 → v0.4.1
• github.com/moby/sys/userns v0.1.0 → v0.2.1
• github.com/nwaples/rardecode/v2 v2.2.0 → v2.4.1
• github.com/olekukonko/tablewriter v1.1.4 → v1.1.5
• github.com/sirupsen/logrus v1.9.4 → v1.10.2
• github.com/ulikunitz/xz v0.5.16 → v0.5.17
• github.com/zclconf/go-cty v1.16.3 → v1.19.0
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 → v0.71.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 → v0.71.0
• go.opentelemetry.io/otel v1.44.0 → v1.46.0
• go.opentelemetry.io/otel/metric v1.44.0 → v1.46.0
• go.opentelemetry.io/otel/metric/x v0.66.0 → v0.68.0
• go.opentelemetry.io/otel/sdk v1.44.0 → v1.46.0 (🟢 remediated GHSA-8wmf-6v46-5gfg)
• go.opentelemetry.io/otel/sdk/metric v1.44.0 → v1.46.0
• go.opentelemetry.io/otel/trace v1.44.0 → v1.46.0
• golang.org/x/crypto v0.56.0 → v0.57.0
• golang.org/x/net v0.58.0 → v0.59.0
• golang.org/x/sync v0.22.0 → v0.23.0
• golang.org/x/sys v0.47.0 → v0.48.0
• golang.org/x/term v0.45.0 → v0.46.0
• golang.org/x/text v0.41.0 → v0.42.0
• golang.org/x/tools v0.49.0 → v0.50.0
• google.golang.org/genproto/googleapis/api v0.0.0-e75dac1 → v0.0.0-da73d73
• google.golang.org/genproto/googleapis/rpc v0.0.0-08b0e42 → v0.0.0-da73d73
• modernc.org/libc v1.75.6 → v1.75.7
• modernc.org/sqlite v1.58.0 → v1.59.0

Added (28 packages)

• cyphar.com/go-pathrs v0.2.5
• github.com/VividCortex/ewma v1.2.0
• github.com/apparentlymart/go-textseg/v17 v17.0.1
• github.com/containerd/log/otel v0.1.0
• github.com/containerd/stargz-snapshotter/estargz v0.18.2
• github.com/containers/libtrust v0.0.0-c1716e8
• github.com/containers/ocicrypt v1.3.2
• github.com/cyberphone/json-canonicalization v0.0.0-19d51d7
• github.com/google/go-intervals v0.0.2
• github.com/mattn/go-sqlite3 v1.14.48
• github.com/miekg/pkcs11 v1.1.2
• github.com/mistifyio/go-zfs/v4 v4.0.0
• github.com/moby/sys/capability v0.4.0
• github.com/opencontainers/selinux v1.15.1
• github.com/proglottis/gpgme v0.1.6
• github.com/secure-systems-lab/go-securesystemslib v0.11.0
• github.com/sigstore/fulcio v1.8.7
• github.com/sigstore/protobuf-specs v0.5.1
• github.com/sigstore/sigstore v1.10.8
• github.com/smallstep/pkcs7 v0.2.1
• github.com/stefanberger/go-pkcs11uri v0.0.0-7828495
• github.com/tchap/go-patricia/v2 v2.3.3
• github.com/vbatts/tar-split v0.12.3
• github.com/vbauerster/cupwriter v0.0.4
• github.com/vbauerster/mpb/v8 v8.14.0
• github.com/youmark/pkcs8 v0.0.0-a2c0da2
• go.podman.io/image/v5 v5.41.2
• go.podman.io/storage v1.64.1

Removed (3 packages)

• github.com/gogo/protobuf v1.3.2
• github.com/moby/sys/sequential v0.6.0
• go.opencensus.io v0.24.0

(Full Changelog)

v1.53.0

Compare Source

helm-unittest/helm-unittest (helm-unittest/helm-unittest)

v1.2.0

Compare Source

Features

• Add opt-in parallel execution of test suites (credits @​michal-marszalek-h2oai)
• Full helm 4 support (resolves #​777, credits @​Szpadel)

Fixes

• Fix arm64 docker images (resolves #​769, resolves #​917)

Updates

• Update packages to latest versions
• Update pipeline actions to latest versions
• Update base images to latest versions
• Update documentation

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[erikgb]

/lgtm
/approve

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [erikgb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment