chore(deps): dependency round — Flux meta 1.38, Argo CD 3.5.6, current pins

.devcontainer/Dockerfile

@@ -79,10 +79,10 @@ ENV PATH="/go/bin:/usr/local/go/bin:${PATH}" \
     HADOLINT_VERSION=2.15.1 \
     VALKEY_VERSION=9.1.2 \
     COSIGN_VERSION=v3.1.4 \
-    ORAS_VERSION=1.3.5 \
+    ORAS_VERSION=1.3.6 \
     NODE_MAJOR=24 \
     MARKDOWNLINT_CLI2_VERSION=0.24.0 \
-    VALE_VERSION=3.24.0 \
+    VALE_VERSION=3.25.1 \
     TRIVY_VERSION=0.76.1
 
 # Fail early on unsupported architectures instead of producing a partial image.

.github/actions/docker-build/action.yml

@@ -57,7 +57,7 @@ runs:
 
     - name: Log in to Container Registry
       if: ${{ inputs.login == 'true' }}
-      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
       with:
         registry: ${{ inputs.registry }}
         username: ${{ inputs.username }}

.github/workflows/ci.yml

@@ -67,7 +67,7 @@ jobs:
 
       - name: Login to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/release.yml

@@ -115,7 +115,7 @@ jobs:
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Login to registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

Dockerfile

@@ -94,7 +94,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:debug@sha256:11c839f18a0d7b91b093cda53a5d4cee84f23ec450a6f6e1bf17ab12bf296333
+FROM gcr.io/distroless/static:debug@sha256:6a5e9a4921c51d613ab8128402badf19d27b16627f92f97146f4597d2c593104
 WORKDIR /
 COPY --from=builder /workspaces/manager .
 COPY --from=sops-builder /out/sops /usr/local/bin/sops

docs/quickstart.md

@@ -25,7 +25,7 @@ you install the chart. (`--set servers.admission.enabled=false` drops the depend
 [chart README](../charts/gitops-reverser/README.md) covers bring-your-own certificates.)
 
 ```bash
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.21.2/cert-manager.yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.21.3/cert-manager.yaml
 kubectl wait --for=condition=ready pod -l app.kubernetes.io/instance=cert-manager -n cert-manager --timeout=300s
 ```
 

docs/spec/e2e-bi-directional-corner.md

@@ -46,8 +46,8 @@ checked in source.
 **The install is pinned to `v3.4.5`**, the latest actual release (`v3.5.0` is
 master's next version and has no tag). Every fact in the tables below was
 re-verified at `v3.4.5` before pinning; line numbers cited are master's, and the
-constants are unchanged between the two. The pin has since moved to `v3.5.5`
-(chart `10.10.5`); the four facts the setup README lists were re-checked at that tag.
+constants are unchanged between the two. The pin has since moved to `v3.5.6`
+(chart `10.11.1`); the four facts the setup README lists were re-checked at that tag.
 
 ### Resource tracking
 
@@ -274,9 +274,9 @@ chart**. `_argocd-installed` `helm pull`s the pinned chart into
 `.stamps/cluster/<ctx>/argocd/` (retryable network step) and `helm upgrade
 --install`s it with `values.yaml` and `--wait`, then gates on CRD establishment.
 
-- `ARGOCD_CHART_VERSION` (e.g. `10.10.5`) lives in `test/e2e/Taskfile-e2e.yml` and pins
+- `ARGOCD_CHART_VERSION` (e.g. `10.11.1`) lives in `test/e2e/Taskfile-e2e.yml` and pins
   the chart, which carries the Argo CD release the specs pin behaviour against (its
-  appVersion, e.g. `v3.5.5`). Unlike `FLUX_VERSION` it is not a devcontainer env
+  appVersion, e.g. `v3.5.6`). Unlike `FLUX_VERSION` it is not a devcontainer env
   var: nothing outside the cluster needs an `argocd` binary — the specs drive Argo
   through `kubectl` alone — so pinning it in the Taskfile avoids a container rebuild.
 - **Why `helm`, not a flat `kubectl apply`.** The chart's `redis-secret-init` runs

go.mod

@@ -6,7 +6,7 @@ require (
 	filippo.io/age v1.3.2
 	github.com/alicebob/miniredis/v2 v2.40.0
 	github.com/cespare/xxhash/v2 v2.3.0
-	github.com/fluxcd/pkg/apis/meta v1.37.0
+	github.com/fluxcd/pkg/apis/meta v1.38.0
 	github.com/go-git/go-billy/v6 v6.0.0-beta.1
 	github.com/go-git/go-git/v6 v6.0.0-beta.1
 	github.com/go-logr/logr v1.4.4
@@ -29,7 +29,7 @@ require (
 	k8s.io/apimachinery v0.37.1
 	k8s.io/apiserver v0.37.1
 	k8s.io/client-go v0.37.1
-	k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
+	k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab
 	sigs.k8s.io/cli-utils v0.37.2
 	sigs.k8s.io/controller-runtime v0.25.2
 	sigs.k8s.io/kustomize/api v0.21.2

go.sum

@@ -49,8 +49,8 @@ github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjT
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
 github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
-github.com/fluxcd/pkg/apis/meta v1.37.0 h1:gVwadRI8BrRrl4Rw0ZBJ/VSWh7qNpf7ShmTjDhcVf30=
-github.com/fluxcd/pkg/apis/meta v1.37.0/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
+github.com/fluxcd/pkg/apis/meta v1.38.0 h1:7t6/DuGFAPx2LE4MsRh1jskjnVE6qELKfr/LrfG7KE8=
+github.com/fluxcd/pkg/apis/meta v1.38.0/go.mod h1:lmdugeiZyt6w+DRm8ypkB+nwrzm+saMbqSfZKGBbTOE=
 github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/fxamacker/cbor/v2 v2.9.3 h1:oQBnFATpNdY8gJHTndDDv5Xl4QqNaz51G5LLEPhng3Q=
@@ -337,8 +337,8 @@ k8s.io/kube-openapi v0.0.0-20260821135717-be32def86098 h1:z5+pcu1jTyKK5mNTe2/+x+
 k8s.io/kube-openapi v0.0.0-20260821135717-be32def86098/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
 k8s.io/streaming v0.37.1 h1:TpzVfQeFuVndn2g9mFqxy1UcUYPwDzqjUmwR/IzJCWc=
 k8s.io/streaming v0.37.1/go.mod h1:APlJR26ZWRcVy5bIEj0QRrKUXROtBHPcxl2NT7EAzPU=
-k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE=
-k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM=
+k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab h1:pjQrNLaF//ytZtWwCAHtW+pqwSKjtWDqzA8+TCX37RI=
+k8s.io/utils v0.0.0-20261023123148-ca04ba58ecab/go.mod h1:DdQ0BJxlQtuMlKDqdg7X5IMMQCXIk2b3d1/4M9OhUYo=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0 h1:/YpDJ4vReG7ZmzSpBGxduXgywWkJU9zHubgJG03MT+Y=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0/go.mod h1:tJo1aepTXyR+8Xs3sUsGBDk4Ub2AM5dPAPKJx0mpm5c=
 sigs.k8s.io/cli-utils v0.37.2 h1:GOfKw5RV2HDQZDJlru5KkfLO1tbxqMoyn1IYUxqBpNg=

test/e2e/Taskfile-e2e.yml

@@ -143,7 +143,7 @@ vars:
   # an argocd binary — the specs drive Argo through kubectl alone — so pinning it
   # here avoids a container rebuild. test/e2e/setup/argocd/README.md lists what to
   # re-verify when bumping.
-  ARGOCD_CHART_VERSION: '{{.ARGOCD_CHART_VERSION | default "10.10.5"}}'
+  ARGOCD_CHART_VERSION: '{{.ARGOCD_CHART_VERSION | default "10.11.1"}}'
   ARGOCD_HELM_REPO: '{{.ARGOCD_HELM_REPO | default "https://argoproj.github.io/argo-helm"}}'
   ARGOCD_NAMESPACE: '{{.ARGOCD_NAMESPACE | default "argocd"}}'
   ARGOCD_DIR: '{{.ARGOCD_DIR | default "test/e2e/setup/argocd"}}'

test/e2e/setup/argocd/README.md

@@ -53,7 +53,7 @@ change turn a real behavioral regression into a silent pass.
 
 `ARGOCD_CHART_VERSION` lives in [`test/e2e/Taskfile-e2e.yml`](../../Taskfile-e2e.yml) and
 pins the chart, which carries a specific Argo CD release (its appVersion; e.g.
-chart `10.10.5` ships `v3.5.5`). When bumping, re-verify against the upstream source
+chart `10.11.1` ships `v3.5.6`). When bumping, re-verify against the upstream source
 **at the appVersion the chart ships** (a checkout lives at
 `external-sources/argo-cd`; read the tag, not master):
 

test/e2e/setup/argocd/values.yaml

@@ -41,7 +41,7 @@ notifications:
 # bi-directional leg failed in `_argocd-installed` on 8 CI runs between 2026-09-30 and 2026-10-19,
 # every one with argocd-redis in ImagePullBackOff on "429 Too Many Requests". mirror.gcr.io is
 # Google's Docker Hub cache and serves the same image: the tag pinned here is the chart's
-# redis.image.tag (8.6.4-alpine for chart 10.10.5), by its mirror.gcr.io digest. Re-pin both on
+# redis.image.tag (8.6.4-alpine for chart 10.11.1), by its mirror.gcr.io digest. Re-pin both on
 # an Argo CD chart bump.
 redis:
   image:

test/e2e/setup/flux/releases/cert-manager.yaml

@@ -13,7 +13,7 @@ spec:
         kind: HelmRepository
         name: jetstack
         namespace: flux-system
-      version: v1.21.2
+      version: v1.21.3
   install:
     createNamespace: false
     crds: Create

test/e2e/setup/flux/releases/reflector.yaml

@@ -10,7 +10,7 @@ spec:
     mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
     operation: copy
   ref:
-    semver: "10.0.65"
+    semver: "10.0.68"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease

test/e2e/setup/flux/repositories/prometheus-operator.yaml

@@ -7,4 +7,4 @@ spec:
   interval: 30m
   url: https://github.com/prometheus-operator/prometheus-operator
   ref:
-    tag: v0.94.1
+    tag: v0.94.2