Merge remote-tracking branch 'origin/main' into protobuf

.github/chainguard/lifecycle-cve-dashboard.sts.yaml

@@ -0,0 +1,8 @@
+issuer: https://accounts.google.com
+
+# have more than one service account
+# lc-cve-dashboard-bot@staging-enforce-cd1e.iam.gserviceaccount.com
+subject_pattern: "(107513915972546566458)"
+
+permissions:
+  contents: read

aws-crt-cpp.yaml

@@ -1,6 +1,6 @@
 package:
   name: aws-crt-cpp
-  version: 0.29.5
+  version: 0.29.6
   epoch: 0
   description: "C++ wrapper around the aws-c-* libraries. Provides Cross-Platform Transport Protocols and SSL/TLS implementations for C++"
   copyright:
@@ -33,7 +33,7 @@ pipeline:
     with:
       repository: https://github.com/awslabs/aws-crt-cpp
       tag: v${{package.version}}
-      expected-commit: 9ffe4ef8df4dcfdccb6eba7fa79590a84b29f29e
+      expected-commit: 57a0b8f03e11dc34b2c423519934e492ed96fa96
 
   - runs: |
       if [ "$CBUILD" != "$CHOST" ]; then

aws-eks-pod-identity-agent.yaml

@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
   name: aws-eks-pod-identity-agent
-  version: 0_git20241128
+  version: 0_git20241130
   epoch: 0
   description: EKS Pod Identity is a feature of Amazon EKS that simplifies the process for cluster administrators to configure Kubernetes applications with AWS IAM permissions
   copyright:

bats.yaml

@@ -1,7 +1,7 @@
 package:
   name: bats
-  version: 1.11.0
-  epoch: 2
+  version: 1.11.1
+  epoch: 0
   description: Bash Automated Testing System
   copyright:
     - license: MIT
@@ -23,7 +23,7 @@ pipeline:
     with:
       repository: https://github.com/bats-core/bats-core
       tag: v${{package.version}}
-      expected-commit: 5da66876b8b619235aee1eb3e54954eaca88059b
+      expected-commit: b640ec3cf2c7c9cfc9e6351479261186f76eeec8
 
   - runs: |
       ./install.sh "${{targets.contextdir}}/usr"

benchmark.yaml

@@ -1,7 +1,7 @@
 package:
   name: benchmark
-  version: 1.9.0
-  epoch: 1
+  version: 1.9.1
+  epoch: 0
   description: "microbenchmark support library"
   copyright:
     - license: Apache-2.0
@@ -21,7 +21,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 12235e24652fc7f809373e7c11a5f73c5763fc4c
+      expected-commit: c58e6d0710581e3a08d65c349664128a8d9a2461
       repository: https://github.com/google/benchmark
       tag: v${{package.version}}
 

bmake.yaml

@@ -1,7 +1,7 @@
 package:
   name: bmake
-  version: "20240921"
-  epoch: 1
+  version: "20241124"
+  epoch: 0
   description: Portable version of the NetBSD make build tool
   copyright:
     - license: BSD-2-Clause
@@ -18,7 +18,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: b346579e82d296d1a4da29dea8594e3ee596130b20786dec0f3899a3e11275c2
+      expected-sha256: 4f66406091c2f85ea964b238d69eb8f71ab4baac9dca4687a71883ba6de4ddb2
       uri: https://www.crufty.net/ftp/pub/sjg/bmake-${{package.version}}.tar.gz
       strip-components: 0
 

btrfs-progs.yaml

@@ -1,7 +1,7 @@
 package:
   name: btrfs-progs
-  version: "6.11"
-  epoch: 2
+  version: "6.12"
+  epoch: 0
   description: BTRFS filesystem utilities
   copyright:
     - license: GPL-2.0-or-later
@@ -37,7 +37,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://www.kernel.org/pub/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${{package.version}}.tar.xz
-      expected-sha512: fad3c7e908e2020a3983f9737a7e87367023e2ad35aea14197e2bfa71c1e0435bc3da3f7e6ef463de47c033323163f8b1b7933013042c6fcea673d0f4723ade1
+      expected-sha512: 57da37f460a33b5f5232a5c8e67eb5976fb13483a1437112bd433b179bc0e497a1aadfe24705eb4fb4e0a98d2a33fd3c46808b3ca161421475442a70b964c446
 
   - uses: autoconf/configure
     with:

bun-bootstrap.yaml

@@ -1,6 +1,6 @@
 package:
   name: bun-bootstrap
-  version: 1.1.37
+  version: 1.1.38
   epoch: 0
   description: "Bun requires itself to bootstrap."
   copyright:
@@ -23,13 +23,13 @@ pipeline:
         uses: fetch
         with:
           uri: "https://github.com/oven-sh/bun/releases/download/bun-v${{package.version}}/bun-linux-aarch64.zip"
-          expected-sha256: "6a2ef497ddcc8fb9b78add876d340c20d7642858e159f93ab5bcb406483ffdd2"
+          expected-sha256: "3b08fd0b31f745509e1fed9c690c80d1a32ef2b3c8d059583f643f696639bd21"
           extract: false
       - if: ${{build.arch}} == 'x86_64'
         uses: fetch
         with:
           uri: "https://github.com/oven-sh/bun/releases/download/bun-v${{package.version}}/bun-linux-x64.zip"
-          expected-sha256: "cc7a53917edc9b65778bacdfca21e9acfbd1f2f69742d616980377a78620e974"
+          expected-sha256: "a61da5357e28d4977fccd4851fed62ff4da3ea33853005c7dd93dac80bc53932"
           extract: false
 
   - runs: |

bun.yaml

@@ -1,6 +1,6 @@
 package:
   name: bun
-  version: 1.1.37
+  version: 1.1.38
   epoch: 0
   description: "Incredibly fast JavaScript runtime, bundler, test runner, and package manager - all in one"
   copyright:
@@ -54,7 +54,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/oven-sh/bun
-      expected-commit: 8ca0eb831d6739c6a94b3f4d484bbfe71ee97226
+      expected-commit: bf2f153f5ca45876bc88369273743cd6fa04881c
       tag: bun-v${{package.version}}
 
   - runs: |

cargo-c.yaml

@@ -1,7 +1,7 @@
 package:
   name: cargo-c
-  version: 0.10.5
-  epoch: 1
+  version: 0.10.7
+  epoch: 0
   description: build and install C-compatible libraries
   copyright:
     - license: MIT
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/lu-zero/cargo-c
       tag: v${{package.version}}
-      expected-commit: b6081a47813aab0175645e332b14282c651c893d
+      expected-commit: 8914ddfa8d45a0c27abdb48708138a5bc32e5bd6
 
   - runs: |
       cargo  auditable build --release

conda-build.yaml

@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/conda-build/
 package:
   name: conda-build
-  version: 24.11.1
+  version: 24.11.2
   epoch: 0
   description: tools for building conda packages
   copyright:
@@ -35,7 +35,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 1d4235a8a8ced33c7b76ab31aff18a2fa0c7ec2b
+      expected-commit: 07a10e20fa71240bf828dda81bbee72912fe70d1
       repository: https://github.com/conda/conda-build
       tag: ${{package.version}}
 

crossplane.yaml

@@ -1,6 +1,6 @@
 package:
   name: crossplane
-  version: 1.18.0
+  version: 1.18.1
   epoch: 0
   description: Cloud Native Control Planes
   copyright:
@@ -13,7 +13,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: e663a43ece850e93fe5cdebb2e478e2fb9762ad1
+      expected-commit: 0ca82e4f152067f69af11d907ab7b4a0a21fed37
       repository: https://github.com/crossplane/crossplane
       tag: v${{package.version}}
 

datadog-security-agent-policies.yaml

@@ -1,6 +1,6 @@
 package:
   name: datadog-security-agent-policies
-  version: 0.60.0
+  version: 0.61.0
   epoch: 0
   description: "Policies for Security Agent - compliance and runtime checks"
   copyright:
@@ -16,7 +16,7 @@ pipeline:
     with:
       repository: https://github.com/DataDog/security-agent-policies
       tag: v${{package.version}}
-      expected-commit: 190c4e2f71e5165c6bd53cf7de0b152f2988a890
+      expected-commit: 30a6bff39e8afc84015b8e54eb48ab95c74b073d
 
   - runs: |
       mkdir -p ${{targets.destdir}}/etc/datadog-agent/compliance.d

ddp-tool.yaml

@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-commit,valid-pipeline-git-checkout-tag
 package:
   name: ddp-tool
-  version: 1.0.34.0_git20241128
+  version: 1.0.34.0_git20241130
   epoch: 0
   description: Intel Dynamic Device Personalization Tool
   copyright:

deno.yaml

@@ -1,6 +1,6 @@
 package:
   name: deno
-  version: 2.1.1
+  version: 2.1.2
   epoch: 0
   description: "A modern runtime for JavaScript and TypeScript."
   copyright:
@@ -30,7 +30,7 @@ pipeline:
     with:
       repository: https://github.com/denoland/deno
       tag: v${{package.version}}
-      expected-commit: 5d71b461530f7c374c08701cef5678a5a4ac5484
+      expected-commit: 2039abe8d2bc82fa800f4118707a48ac6f5e02ae
 
   - name: Configure and build
     runs: |

dynamic-localpv-provisioner.yaml

@@ -1,7 +1,7 @@
 package:
   name: dynamic-localpv-provisioner
-  version: 4.1.1
-  epoch: 1
+  version: 4.1.2
+  epoch: 0
   description: Dynamic Local Volumes for Kubernetes Stateful workloads.
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/openebs/dynamic-localpv-provisioner
       tag: v${{package.version}}
-      expected-commit: 689f5cd6b655adb84a3f94d83bb705259d31c762
+      expected-commit: 86db732d589cbdebb2d53f2a19f8e44430cb345b
 
   - uses: go/bump
     with:

eslint.yaml

@@ -1,6 +1,6 @@
 package:
   name: eslint
-  version: 9.15.0
+  version: 9.16.0
   epoch: 0
   description: An AST-based pattern checker for JavaScript
   copyright:
@@ -25,7 +25,7 @@ pipeline:
     with:
       repository: https://github.com/eslint/eslint
       tag: v${{package.version}}
-      expected-commit: 6f37b0747a14dfa9a9e3bdebc5caed1f39b6b0e2
+      expected-commit: cbf7db0ddfa3b789f7ebc27a66993c08a83e72cd
 
   - runs: |
       npm install --omit=dev --legacy-peer-deps

fluent-plugin-tag-normaliser.yaml

@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-tag
 package:
   name: fluent-plugin-tag-normaliser
-  version: 0_git20241128
+  version: 0_git20241130
   epoch: 0
   description: Tag-normaliser is a `fluentd` plugin to help re-tag logs with Kubernetes metadata. It uses special placeholders to change tag.
   copyright:

font-padauk.yaml

@@ -1,6 +1,6 @@
 package:
   name: font-padauk
-  version: 5.001
+  version: "5.100"
   epoch: 0
   description: Padauk pan Myanmar font
   copyright:
@@ -25,7 +25,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/silnrsi/font-padauk
-      expected-commit: 278b8efb03c0ca0d7f29fb3edc1f52489ebb384f
+      expected-commit: a84fd3c83bc6e6ec120ca0a24b726c6e19e26bb1
       tag: v${{package.version}}
 
   - runs: |

git-lfs.yaml

@@ -1,7 +1,7 @@
 package:
   name: git-lfs
   version: 3.6.0
-  epoch: 1
+  epoch: 2
   description: "large file support for git"
   copyright:
     - license: MIT
@@ -12,9 +12,9 @@ package:
     post-install: |
       #!/bin/sh
       git-lfs install --skip-repo --system
-    post-deinstall: |
+    pre-deinstall: |
       #!/bin/sh
-      rm -f /etc/gitconfig
+      git lfs uninstall --skip-repo --system
 
 pipeline:
   - uses: git-checkout

go-discover.yaml

@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-tag
 package:
   name: go-discover
-  version: 0_git20241128
+  version: 0_git20241130
   epoch: 0
   description: go-discover is a Go (golang) library and command line tool to discover ip addresses of nodes in cloud environments based on meta information like tags provided by the environment.
   copyright:

grafana-rollout-operator.yaml

@@ -1,7 +1,7 @@
 package:
   name: grafana-rollout-operator
-  version: 0.20.1
-  epoch: 1
+  version: 0.21.0
+  epoch: 0
   description: Kubernetes Rollout Operator
   copyright:
     - license: Apache-2.0
@@ -11,7 +11,7 @@ pipeline:
     with:
       repository: https://github.com/grafana/rollout-operator
       tag: v${{package.version}}
-      expected-commit: e74c10fade60ae17d522dbaf7d152f5c894d1849
+      expected-commit: b1e8ac46d861e1759d321c91404e593a1db8ea39
 
   - uses: go/build
     with:

grpcurl.yaml

@@ -1,7 +1,7 @@
 package:
   name: grpcurl
-  version: 1.9.1
-  epoch: 6
+  version: 1.9.2
+  epoch: 0
   description: CLI tool to interact with gRPC servers
   copyright:
     - license: MIT
@@ -22,14 +22,10 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 400fa5f2d354f662c2e39c8b1f8ef71f50498075
+      expected-commit: b9a11e9fea796d968e2dd83573312ead4b6fd831
       repository: https://github.com/fullstorydev/grpcurl
       tag: v${{package.version}}
 
-  - uses: go/bump
-    with:
-      deps: golang.org/x/[email protected] google.golang.org/[email protected] google.golang.org/[email protected]
-
   - uses: go/build
     with:
       packages: ./cmd/grpcurl