[sunib]

Stacked on #448.

A routine dependency round. It is not what fixes the vulnerability report against the published image: every CVE in that report (stdlib 1.27.1, golang.org/x/net v0.59.0) matches v0.53.0, which was built before #435 moved to Go 1.27.3, x/net v0.61.0 and x/crypto v0.58.0. Those fixes are already on main and ship with the next release. govulncheck against Go 1.27.3 finds nothing reachable, in the main module or in the SOPS build.

The one finding that remains is GO-2026-5932. It is the advisory that golang.org/x/crypto/openpgp is unmaintained, and it has no fixed version. Nothing here imports that package, so it stays UNKNOWN on any image that links x/crypto. It cannot fail task scan-image, which only blocks CRITICAL findings that have a fix.

Go modules

• github.com/fluxcd/pkg/apis/meta v1.37.0 → v1.38.0
• k8s.io/utils → 20261023

The Kubernetes libraries stay on v0.37.1, since 1.38 has only alphas. Flux meta v1.38.0 is Flux's own version number and still requires apimachinery v0.37.1. kustomize stays at v0.21.2 for the same reason as #440.

Images, Actions, devcontainer

• gcr.io/distroless/static:debug: current digest
• docker/login-action v4.6.0 → v4.7.0
• oras 1.3.6, Vale 3.25.1. Vale gives the same output as 3.24.0 on every file .docs-lint-scope gates.

All other devcontainer tools, the golang 1.27.3 images and the other Actions are already current.

e2e cluster

• cert-manager v1.21.3 (also the quickstart URL), reflector 10.0.68, prometheus-operator CRDs v0.94.2
• Argo CD chart 10.11.1 (v3.5.6). The four facts the setup README asks to re-verify still hold: the four source files it names are byte-identical to v3.5.5. The chart still leaves the tracking method and server-side apply unset. Its redis tag is still 8.6.4-alpine, and the mirror.gcr.io digest is unchanged.

Validation

task lint and task test pass locally; e2e is running in CI.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!