Merge pull request #22 from chainguard-dev/create-pull-request/patch

Export stereo/os: refs/heads/main

Author: xnox

airflow-3.yaml

@@ -1,7 +1,7 @@
 package:
   name: airflow-3
   version: "3.1.8"
-  epoch: 1
+  epoch: 2
   description: Platform to programmatically author, schedule, and monitor workflows
   options:
     #  There is a dependency on libarrow.so although it
@@ -78,6 +78,7 @@ pipeline:
       packages: |
         commons-lang3==3.18.0 # GHSA-j288-q9x7-2f5v
         authlib==1.6.9 # GHSA-7wc2-qxgw-g8gg
+        tornado==6.5.5
 
   - runs: |
       # ZIP doesn't handle the SDE we set correctly, so set it to 1980-01-01

amazon-cloudwatch-agent.yaml

@@ -1,7 +1,7 @@
 package:
   name: amazon-cloudwatch-agent
-  version: "1.300064.1"
-  epoch: 1 # CVE-2026-27139
+  version: "1.300065.0"
+  epoch: 0 # CVE-2026-27139
   description: CloudWatch Agent enables you to collect and export host-level metrics and logs on instances running Linux or Windows server.
   copyright:
     - license: Apache-2.0
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/aws/amazon-cloudwatch-agent
       tag: v${{package.version}}
-      expected-commit: ef6516fb8e4d16ca9b92cc504d8d768862b09b93
+      expected-commit: 7321479f518c441957d5eb06fe3fa2c636214b53
 
   - uses: go/build
     with:

apko.yaml

@@ -1,7 +1,7 @@
 package:
   name: apko
   version: "1.1.15"
-  epoch: 2 # CVE-2026-27141
+  epoch: 3 # CVE-2026-27141
   description: Build OCI images using APK directly without Dockerfile
   copyright:
     - license: Apache-2.0
@@ -41,7 +41,7 @@ test:
       with:
         bins: apko
     - runs: |
-        cat <<EOF >> /tmp/wolfi-base.yaml
+        cat <<'EOF' >> /tmp/wolfi-base.yaml
         contents:
           keyring:
             - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub

atmoz-sftp.yaml

@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-commit,valid-pipeline-git-checkout-tag
 package:
   name: atmoz-sftp
-  version: "0.0.0_git20260317"
+  version: "0.0.0_git20260318"
   epoch: 0
   description: Various scripts from https://github.com/atmoz/sftp to help run SFTP in a container
   copyright:

aws-c-io.yaml

@@ -1,7 +1,7 @@
 package:
   name: aws-c-io
-  version: "0.26.1"
-  epoch: 1
+  version: "0.26.2"
+  epoch: 0
   description: Module for the AWS SDK for C handling all IO and TLS work for application protocols
   copyright:
     - license: Apache-2.0
@@ -22,7 +22,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: bfb0819d3906502483611ce832a5ec6b897c8421
+      expected-commit: 33509a46e90bbb7557381b7341834f0dc193f6c8
       repository: https://github.com/awslabs/aws-c-io
       tag: v${{package.version}}
 

aws-c-mqtt.yaml

@@ -1,6 +1,6 @@
 package:
   name: aws-c-mqtt
-  version: "0.15.0"
+  version: "0.15.1"
   epoch: 0 # go/wolfi-rsc/aws-c-mqtt
   description: AWS C99 implementation of the MQTT 3.1.1 specification
   copyright:
@@ -28,7 +28,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: dc2fe7be81070f7c5095ad386d9a23c180a4276b
+      expected-commit: e924c6c3031a2c9336fe052399f36048e8b79431
       repository: https://github.com/awslabs/aws-c-mqtt
       tag: v${{package.version}}
 

aws-cli-2.yaml

@@ -2,7 +2,7 @@
 #nolint:documentation
 package:
   name: aws-cli-2
-  version: "2.34.10"
+  version: "2.34.11"
   epoch: 0 # go/wolfi-rsc/aws-cli-2
   description: "Universal Command Line Interface for Amazon Web Services (v2)"
   copyright:
@@ -45,7 +45,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/aws/aws-cli
-      expected-commit: 7309c49d8d10a8232031c4baa6a020c505f2f06b
+      expected-commit: 57ecccd7feb0a0f07c4bd6f9088ca52b21b0e384
       tag: ${{package.version}}
 
   - runs: |

bun-bootstrap.yaml

@@ -1,6 +1,6 @@
 package:
   name: bun-bootstrap
-  version: "1.3.10"
+  version: "1.3.11"
   epoch: 0
   description: "Bun requires itself to bootstrap."
   copyright:
@@ -23,13 +23,13 @@ pipeline:
         uses: fetch
         with:
           uri: "https://github.com/oven-sh/bun/releases/download/bun-v${{package.version}}/bun-linux-aarch64.zip"
-          expected-sha256: "fa5ecb25cafa8e8f5c87a0f833719d46dd0af0a86c7837d806531212d55636d3"
+          expected-sha256: "d13944da12a53ecc74bf6a720bd1d04c4555c038dfe422365356a7be47691fdf"
           extract: false
       - if: ${{build.arch}} == 'x86_64'
         uses: fetch
         with:
           uri: "https://github.com/oven-sh/bun/releases/download/bun-v${{package.version}}/bun-linux-x64.zip"
-          expected-sha256: "f57bc0187e39623de716ba3a389fda5486b2d7be7131a980ba54dc7b733d2e08"
+          expected-sha256: "8611ba935af886f05a6f38740a15160326c15e5d5d07adef966130b4493607ed"
           extract: false
 
   - runs: |

cloudnative-pg.yaml

@@ -1,7 +1,7 @@
 package:
   name: cloudnative-pg
   version: "1.28.1"
-  epoch: 1 # go/wolfi-rsc/cloudnative-pg
+  epoch: 2
   description: CloudNativePG is a comprehensive platform designed to seamlessly manage PostgreSQL databases
   copyright:
     - license: Apache-2.0
@@ -85,3 +85,8 @@ test:
         manager_${{build.goarch}} version | grep "${{package.version}}"
         /manager version | grep "${{package.version}}"
         /manager debug show-architectures | grep ${{build.goarch}}
+
+environment:
+  contents:
+    packages:
+      - go-1.25

cloudprober.yaml

@@ -1,7 +1,7 @@
 package:
   name: cloudprober
   version: "0.14.2"
-  epoch: 0 # GHSA-9h8m-3fm2-qjrq
+  epoch: 1
   description: An active monitoring software to detect failures before your customers do.
   copyright:
     - license: Apache-2.0
@@ -51,3 +51,8 @@ test:
       runs: |
         cloudprober --help
         cloudprober -buildinfo
+
+environment:
+  contents:
+    packages:
+      - go-1.25