Merge branch 'main' into wolfictl-db15e0eb-4f6b-40c3-a635-3007006b6eaa

Signed-off-by: Carlos Tadeu Panato Junior <cpanato@chainguard.dev>

.gitignore

@@ -9,6 +9,7 @@ dag.svg
 .melange.k8s.yaml
 packages.log
 *.iml
+*.apk
 APKINDEX.tar.gz
 
 # macOS

ack.yaml

@@ -1,6 +1,6 @@
 package:
   name: ack
-  version: 3.8.0
+  version: 3.8.1
   epoch: 0
   description: A Perl-powered replacement for grep
   copyright:
@@ -21,7 +21,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 640b1a1b36ca15a4d1d1792f2a44e69aeae58391cf0d21fa8a29665a8895f718
+      expected-sha256: 1c03ab46f4922a0bd2462f4cf7eeb3cb4b4e6d43cebd3cfcf3a2e132319eb88e
       uri: https://cpan.metacpan.org/authors/id/P/PE/PETDANCE/ack-v${{package.version}}.tar.gz
 
   - runs: PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor

amazon-k8s-cni.yaml

@@ -1,7 +1,7 @@
 package:
   name: amazon-k8s-cni
-  version: 1.19.0
-  epoch: 1
+  version: 1.19.2
+  epoch: 0
   description: Networking plugin repository for pod networking in Kubernetes using Elastic Network Interfaces on AWS
   copyright:
     - license: Apache-2.0
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/aws/amazon-vpc-cni-k8s
       tag: v${{package.version}}
-      expected-commit: edf5738a1b3db4e554e38d43090421cd0c60d353
+      expected-commit: 847372a017457306cf7d14c65094c1cdc70f8971
 
   - name: Copy conflist
     runs: |

apache-nifi.yaml

@@ -1,7 +1,7 @@
 package:
   name: apache-nifi
   version: 2.1.0
-  epoch: 0
+  epoch: 1
   description: Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data.
   copyright:
     - license: Apache-2.0

apache-nifi/pombump-deps.yaml

@@ -5,3 +5,6 @@ patches:
     - groupId: spring-ldap-core
       artifactId: spring-ldap-core
       version: 3.2.8
+    - groupId: org.apache.mina
+      artifactId: mina-core
+      version: 2.2.4

apache-tika-3.0.yaml

@@ -1,13 +1,14 @@
 package:
   name: apache-tika-3.0
   version: 3.0.0
-  epoch: 1
+  epoch: 3
   description: The Apache Tika toolkit detects and extracts metadata and text from over a thousand different file types (such as PPT, XLS, and PDF).
   copyright:
     - license: Apache-2.0
   dependencies:
     runtime:
-      - openjdk-17-jre
+      - dash-binsh
+      - openjdk-17-default-jvm
     provides:
       - apache-tika=${{package.full-version}}
 
@@ -33,11 +34,6 @@ pipeline:
       tag: ${{package.version}}
       expected-commit: 9bcb38d6734ed9d5dcff617f316c535e844c68d1
 
-  - uses: maven/pombump
-    with:
-      patch-file: patches.yaml
-      pom: tika-parent/pom.xml
-
   - runs: |
       mvn clean install -am -DskipTests -Dossindex.skip
       mkdir -p "${{targets.contextdir}}"/usr/share/java/
@@ -49,7 +45,7 @@ subpackages:
     pipeline:
       - runs: |
           mkdir -p "${{targets.subpkgdir}}"
-          ln -sf /usr/share/java/tika-server-standard-${{package.version}}.jar ${{targets.subpkgdir}}/tika-server-standard-${{package.version}}.jar
+          ln -sf /usr/share/java/tika-server-standard-${{package.version}}.jar ${{targets.subpkgdir}}/tika-server-standard.jar
 
 update:
   enabled: true
@@ -64,12 +60,12 @@ test:
       packages:
         - curl
         - ${{package.name}}-compat
+        - openjdk-17-default-jvm
   pipeline:
     - name: "start server and verify endpoint"
       runs: |
-        TIKA_JAR=$(ls /tika-server-standard-*.jar 2>/dev/null | head -n 1)
         (
-          java -jar /tika-server-standard-3.0.0.jar &
+        java -jar /tika-server-standard.jar &
         ) && \
         sleep 2 && \
         curl -s http://localhost:9998/ | \

atuin.yaml

@@ -1,7 +1,7 @@
 package:
   name: atuin
-  version: 18.3.0
-  epoch: 3
+  version: 18.4.0
+  epoch: 0
   description: Magical shell history
   copyright:
     - license: MIT
@@ -22,11 +22,14 @@ pipeline:
     with:
       repository: https://github.com/atuinsh/atuin
       tag: v${{package.version}}
-      expected-commit: 9be49e434e549d6b13928b530139b66fef6171f1
+      expected-commit: dc7c26a640b1a134528caa894b3339c443b917b4
 
   - uses: rust/cargobump
 
   - runs: |
+      # mitigate GHSA-h97m-ww89-6jmq
+      cargo update url --precise 2.5.4
+      cargo update idna --precise 1.0.3
       cargo auditable build --locked --release
       cd target/release
       mkdir -p completions

atuin/cargobump-deps.yaml

@@ -1,3 +1,5 @@
 packages:
     - name: curve25519-dalek
       version: 4.1.3
+    - name: tonic
+      version: 0.12.3

aws-cli-2.yaml

@@ -2,7 +2,7 @@
 #nolint:documentation
 package:
   name: aws-cli-2
-  version: 2.22.23
+  version: 2.22.26
   epoch: 0
   description: "Universal Command Line Interface for Amazon Web Services (v2)"
   copyright:
@@ -33,7 +33,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/aws/aws-cli
-      expected-commit: de43a3e9ba637457f6e8e73e87c42cdef103e916
+      expected-commit: a66727a13a676904a10a088f5a1ca55a0c90f0db
       tag: ${{package.version}}
 
   - runs: |

aws-eks-pod-identity-agent.yaml

@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
   name: aws-eks-pod-identity-agent
-  version: 0_git20241225
+  version: 0_git20241231
   epoch: 0
   description: EKS Pod Identity is a feature of Amazon EKS that simplifies the process for cluster administrators to configure Kubernetes applications with AWS IAM permissions
   copyright:

bc.yaml

@@ -1,8 +1,8 @@
 # Generated from https://git.alpinelinux.org/aports/plain/main/bc/APKBUILD
 package:
   name: bc
-  version: 1.07.1
-  epoch: 3
+  version: 1.08.0
+  epoch: 0
   description: An arbitrary precision numeric processing language (calculator)
   copyright:
     - license: GPL-3.0-or-later
@@ -25,7 +25,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 62adfca89b0a1c0164c2cdca59ca210c1d44c3ffc46daf9931cf4942664cb02a
+      expected-sha256: 7db49996cbe16d7602936fef586e69e492c3df65765c0a891841025a1ad741ef
       uri: https://ftp.gnu.org/gnu/bc/bc-${{package.version}}.tar.gz
 
   - uses: autoconf/configure

brew.yaml

@@ -1,6 +1,6 @@
 package:
   name: brew
-  version: 4.4.13
+  version: 4.4.14
   epoch: 0
   description: "The homebrew package manager"
   copyright:
@@ -49,7 +49,7 @@ pipeline:
       repository: https://github.com/Homebrew/brew
       tag: ${{package.version}}
       destination: ./brew
-      expected-commit: 6ea9df68df4868ce12ea7c51c85b57dce514f2e8
+      expected-commit: f84082963da8af8c9ccd6dffbe932eba457e2b78
 
   - runs: |
       set -x

caddy.yaml

@@ -1,7 +1,7 @@
 package:
   name: caddy
-  version: 2.8.4
-  epoch: 7
+  version: 2.9.0
+  epoch: 0
   description: Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
   copyright:
     - license: Apache-2.0
@@ -17,7 +17,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 7088605cc11c52c2777ab613dfc5c2a9816006e4
+      expected-commit: 3f3f8b3d5270add46d5fc7d99bdcc705ad2d5df4
       repository: https://github.com/caddyserver/caddy
       tag: v${{package.version}}
 
@@ -27,10 +27,6 @@ pipeline:
 
   - runs: tar cfv caddy-src.tar .
 
-  - uses: go/bump
-    with:
-      deps: github.com/quic-go/quic-go@v0.48.2 golang.org/x/crypto@v0.31.0 golang.org/x/net@v0.33.0
-
   - uses: go/build
     with:
       output: caddy

chezmoi.yaml

@@ -1,7 +1,7 @@
 package:
   name: chezmoi
-  version: 2.56.0
-  epoch: 2
+  version: 2.57.0
+  epoch: 0
   description: Manage your dotfiles across multiple diverse machines, securely.
   copyright:
     - license: MIT
@@ -20,11 +20,7 @@ pipeline:
     with:
       repository: https://github.com/twpayne/chezmoi
       tag: v${{package.version}}
-      expected-commit: 3558b71471e91230ca4e87c1969c9dca62cd9b54
-
-  - uses: go/bump
-    with:
-      deps: filippo.io/age@v1.2.1 golang.org/x/net@v0.33.0
+      expected-commit: 9212b40bac1186ff393da8714579cfdc4816cc20
 
   - uses: go/build
     with:

confluent-docker-utils.yaml

@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates
 package:
   name: confluent-docker-utils
-  version: 0.0.137
+  version: 0.0.140
   epoch: 0
   description: This package provides Docker Utility Belt (dub) and Confluent Platform Utility Belt (cub).
   copyright:
@@ -31,7 +31,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 2b78161024ce03bc470b65f3396fe777be90342d
+      expected-commit: 17012b7e265093efa4a1eb72ba46e32a5e872692
       repository: https://github.com/confluentinc/confluent-docker-utils
       tag: v${{package.version}}
 

confluent-kafka-images.yaml

@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates
 package:
   name: confluent-kafka-images
-  version: 7.9.0.28
+  version: 7.9.0.29
   epoch: 0
   description: Provides build files for Apache Kafka and Confluent Docker images
   copyright:
@@ -22,7 +22,7 @@ var-transforms:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: a120757ea9bc5570bdbfb81bbeb73f17c71673fa
+      expected-commit: 89f113f6ec18446ea766ed99ce8a43f932b42d14
       repository: https://github.com/confluentinc/kafka-images
       tag: v${{vars.mangled-package-version}}
 

confluent-kafka.yaml

@@ -8,7 +8,7 @@ package:
   # with the `version:` field.
   # 2. Created a new variable `mangled-package-version` to append `-ccs` to the
   # version.
-  version: 8.0.0.282
+  version: 8.0.0.300
   epoch: 0
   description: Community edition of Confluent Kafka.
   copyright:
@@ -46,7 +46,7 @@ var-transforms:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 7c5fdf6d34159cc962bd8e8aca3c18f422cadfd7
+      expected-commit: ffbf56ebd04ff9a79c9124f0b2f9b1c16a89f405
       repository: https://github.com/confluentinc/kafka
       tag: v${{vars.mangled-package-version}}
 

controller-gen.yaml

@@ -1,7 +1,7 @@
 package:
   name: controller-gen
-  version: 0.16.5
-  epoch: 1
+  version: 0.17.0
+  epoch: 0
   description: Tools to use with the controller-runtime libraries
   copyright:
     - license: Apache-2.0
@@ -20,12 +20,7 @@ pipeline:
     with:
       repository: https://github.com/kubernetes-sigs/controller-tools
       tag: v${{package.version}}
-      expected-commit: 23a31fde6e1bb6606be870472cb5dd2d7655a5d7
-
-  - uses: go/bump
-    with:
-      deps: golang.org/x/net@v0.33.0
-      modroot: .
+      expected-commit: c71f90318f2c818b93a4458e42f7c4da416d5368
 
   - uses: go/build
     with:

croc.yaml

@@ -1,7 +1,7 @@
 package:
   name: croc
-  version: 10.1.3
-  epoch: 3
+  version: 10.2.1
+  epoch: 0
   description: Easily and securely send things from one computer to another
   copyright:
     - license: MIT
@@ -21,13 +21,9 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/schollz/croc
-      expected-commit: 65bda643515d301ba152af0cdbdcdc1f7e304291
+      expected-commit: 08f9d393e213c6c68984e0aa68b98dfe285db45e
       tag: v${{package.version}}
 
-  - uses: go/bump
-    with:
-      deps: golang.org/x/crypto@v0.31.0 golang.org/x/net@v0.33.0
-
   - uses: go/build
     with:
       packages: .

crossplane-provider-aws.yaml

@@ -1,7 +1,7 @@
 package:
   name: crossplane-provider-aws
-  version: 1.18.1
-  epoch: 1
+  version: 1.18.2
+  epoch: 0
   description: Official AWS Provider for Crossplane by Upbound
   copyright:
     - license: Apache-2.0
@@ -30,18 +30,14 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: b09f81210c3f5a43d0bd54f2e42c5bbe3dbbe4f5
+      expected-commit: 3432e661a77933c15123f4012f9c5b8b59ec396a
       repository: https://github.com/upbound/provider-aws
       tag: v${{package.version}}
 
   - uses: patch
     with:
       patches: uptest_changes.patch
 
-  - uses: go/bump
-    with:
-      deps: golang.org/x/net@v0.33.0
-
   - runs: |
       # `make` downloads `up`, unless we move our prebuilt `up` to where it expects it.
       GOARCH=$(go env GOARCH)