dawid/nextcloud-harvester
Watch
2
0
Fork
You've already forked nextcloud-harvester
 0
Code Issues 1 Pull requests 1 Projects Releases 33 Packages 1 Wiki Activity Actions

Update all non-major dependencies #2

Open
renovate-bot wants to merge 1 commit from renovate/all-minor-patch into main
pull from: renovate/all-minor-patch
merge into: dawid:main
Conversation 1 Commits 1 Files changed 3 +4 -4
renovate-bot commented 2026-11-01 23:40:44 +00:00
Collaborator

This PR contains the following updates:

Package Type Update Change
docker.io/library/python (source) container minor 3.12-slim-bookworm → 3.15-slim-bookworm
ghcr.io/osscontainertools/kaniko container minor v1.28.6-debug → v1.29.0-debug
python (source) final minor 3.12-slim-bookworm → 3.15-slim-bookworm
python (source) stage minor 3.12-slim-bookworm → 3.15-slim-bookworm

Release Notes

osscontainertools/kaniko (ghcr.io/osscontainertools/kaniko)

v1.29.0

Compare Source

Update Notice

⚠️ The slim image no longer authenticates to GCR/GAR, ECR and ACR, and drops the gs://, s3:// and azure build contexts, git build contexts and OpenTelemetry export. If you use any of them, switch to latest, which is now about the same size as slim used to be.

In this Release we activated these feature-flags:

⚠️ Several of these flags change how cache keys are computed. Existing cache entries are invalidated, so the first build after upgrading is a full rebuild that repopulates the cache.

⚠️ --reproducible now leaves base layers untouched and keeps the requested image format, so the digest of a reproducible build changes once. A reproducible build from an OCI base is now pushed as OCI instead of docker, pass --image-format=docker to keep the old format.

FF_KANIKO_ADD_CHECKSUM verifies ADD --checksum. A wrong checksum used to pass silently and now fails the build, so update it to the digest of the download.

FF_KANIKO_EXPAND_HEREDOC expands variables in unquoted COPY and ADD heredoc bodies. If a body needs a literal $, quote the delimiter:

COPY <<'EOF' /etc/motd
costs $5
EOF

FF_KANIKO_PATH_SCOPED_REGISTRY_AUTH matches an auths entry against the repository namespace, so one entry for registry.example.com/org-a covers every repository below it and you can merge your per-repository entries. It is no longer sent to sibling namespaces like registry.example.com/org-b, which now need their own entry.

FF_KANIKO_SHARED_BASE_CACHE keeps downloaded bases in /kaniko/bases after the build, --cleanup does not remove them. If you reuse an executor for many builds, clean that directory yourself.

You can roll-back any of those changes by overriding them in the environment ie.

job:
  variables:
    FF_KANIKO_PLATFORM_CACHE_KEY: "0"
    FF_KANIKO_CROSS_REPO_MOUNT: "0"

Please also notify us by filing a new issue.

We further removed these feature-flags:

  • FF_KANIKO_RUN_MOUNT_BIND
  • FF_KANIKO_NO_PROPAGATE_ANNOTATIONS
  • FF_KANIKO_VOLUME_SKIP_MKDIR
  • FF_KANIKO_PRESERVE_HARDLINKS
  • FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE
  • FF_KANIKO_PRESERVE_MOUNTED_PATHS
  • FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE
  • FF_KANIKO_SECUREJOIN_EXTRACTION
  • FF_KANIKO_WARMER_CACHE_LOCK
  • FF_KANIKO_CLEAN_KANIKO_DIR
  • FF_KANIKO_RELATIVE_LINK_TARGETS
  • FF_KANIKO_OCI_WARMER
  • FF_KANIKO_IGNORE_CACHED_MANIFEST

Their behavior is now unconditional, they have no effect and can be removed.

⚠️ The warmer only reads and writes the OCI layout now. Tarballs left in a warmer cache from before v1.28.0 are no longer used, re-run the warmer to populate the cache.

Community Update

@​gary-wall made their first contribution in #​1205. The warmer now also caches the image index, so builds from a base pinned by index digest work air-gapped.

@​gary-wall also joined us as a maintainer, welcome aboard!

Also many thanks to @​philou-078 and @​hanbyeol for reporting issues fixed in this release.

To get an overview over our feature flags you can check the schedule on https://osscontainertools.org/kaniko/flags/

What's Changed

Security
  • go stdlib v1.26.9: CVE-2026-111943 (eMudhra)
Bugfixes
  • warmer pulls scratch from the registry: by @​gary-wall in #​1205
  • FF_KANIKO_ISOLATE_CACHE_PUSH=false every cache push also writes the build outputs: #​1223
  • warmer leaves nested ARG defaults unexpanded: #​1209
  • FF_KANIKO_WARMER_BUILD_ARGS=false warmer lets an ARG default win over --build-arg: #​1207
  • warmer pulls stage references that differ in case: #​1208
  • FF_KANIKO_WARMER_PREDEFINED_ARGS=false warmer leaves TARGETARCH empty in FROM: #​1210
Standardization
  • FF_KANIKO_RUN_HEREDOC_SCRIPT=false run a lone RUN heredoc body as the script: #​1216
  • FF_KANIKO_COPY_KEEP_DEST_OWNER=false COPY --chown keeps the owner of an existing destination directory: #​1257
  • FF_KANIKO_COPY_SUBDIR_MODE=false directory COPY applies the source mode to existing subdirectories: #​1259
Caching
  • FF_KANIKO_CACHE_IMAGE_INDEX=false warmer caches the image index of index-pinned bases: by @​gary-wall in #​1225
  • FF_KANIKO_FORMAT_INDEPENDENT_CACHE_KEY=false keep --image-format out of cache keys: #​1276
Performance
  • relabel cached layers without downloading them: #​1275
Usability
  • warmer --dryrun prints which bases it would fetch: #​1206
  • graduate feature flags for v1.29.0 release: #​870 #​1235
  • --predefined-annotations sets the OCI source, revision, version and base image annotations: #​1227
  • --provenance attaches a SLSA provenance attestation: #​1230
  • FF_KANIKO_NATIVE_INIT=false kaniko acts as its own init process: #​1222
Telemetry
  • trace the push, planning and the --reproducible rewrite: #​1217
Packaging
  • make the kaniko images reproducible: #​1231
  • ship licenses in the images: #​1247
  • ship credential helpers as hardlinks to the executor: #​1224
  • add busybox and tini sources to the SBOM: #​1246
  • reproducible go build of executor and warmer: by @​gary-wall in #​1269
  • slim image drops the cloud SDKs, go-git and OpenTelemetry: #​1279 #​1265
Maintenance
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.3 to 1.66.6: #​1215 #​1255 #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecrpublic from 1.47.3 to 1.47.6: #​1215 #​1255 #​1274
  • build(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3: #​1226
  • build(deps): bump github.com/klauspost/cpuid/v2 from 2.4.0 to 2.4.1: #​1228
  • build(deps): bump google.golang.org/api from 0.301.0 to 0.308.0: #​1229 #​1245 #​1256 #​1264 #​1283
  • build(deps): bump go from 1.26.9 to 1.27.3: #​1034 #​1271
  • build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.1 to 1.15.0: #​1244
  • build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.31.0 to 2.32.0: #​1243
  • build(deps): bump github.com/docker/cli from 29.9.0 to 29.9.2: #​1242 #​1255
  • build(deps): bump github.com/Microsoft/go-winio from 0.6.3 to 0.6.4: #​1242
  • build(deps): bump github.com/moby/buildkit from 0.34.0 to 0.34.1: #​1249
  • build(deps): bump step-security/harden-runner from 2.22.1 to 2.22.2: #​1253
  • build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.16 to 0.4.19: #​1255 #​1274
  • build(deps): bump anchore/grype from 0.111.1 to 0.121.0: #​1261
  • build(deps): bump k3s-io/k3s from v1.36.2+k3s1 to v1.37.1+k3s1: #​1262 #​1286
  • build(deps): bump docker engine from 29.7.0 to 29.9.2: #​1260
  • build(deps): bump alpine from 3.24.2 to 3.24.3: #​1270
  • build(deps): bump docker/login-action from 4.6.0 to 4.7.0: #​1272
  • build(deps): bump docker/setup-docker-action from 5.5.0 to 5.6.0: #​1272
  • build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.10: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.5: #​1274
  • build(deps): bump github.com/docker/docker-credential-helpers from 0.9.10 to 0.9.12: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.7.22 to 1.7.24: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.9 to 1.20.10: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.20.3 to 1.20.4: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/internal/configsources from 1.5.6 to 1.5.7: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 from 2.8.6 to 2.8.7: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/internal/v4a from 1.5.6 to 1.5.7: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from 1.13.21 to 1.13.22: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/checksum from 1.11.7 to 1.11.8: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/presigned-url from 1.14.6 to 1.14.7: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/s3shared from 1.20.6 to 1.20.7: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/signin from 1.10.4 to 1.10.5: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/sso from 1.38.4 to 1.38.5: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/ssooidc from 1.43.4 to 1.43.5: #​1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts from 1.51.4 to 1.51.5: #​1274
  • build(deps): bump github.com/aws/smithy-go from 1.28.5 to 1.28.6: #​1274
  • build(deps): bump github.com/googleapis/enterprise-certificate-proxy from 0.3.23 to 0.3.24: #​1274
  • build(deps): bump github.com/ProtonMail/go-crypto from 1.4.1 to 1.5.2: #​1184
  • build(deps): bump github.com/googleapis/gax-go/v2 from 2.26.2 to 2.27.0: #​1282
  • build(deps): bump github.com/dimchansky/utfbom from 1.1.1 to 1.2.0: #​1281
  • build(deps): bump github.com/osscontainertools/docker-credential-acr from 0.9.2 to 1.0.0: #​1284
  • build(deps): bump registry from 2 to 3: #​1288
  • build(deps): bump google/cloud-sdk from 256.0.0-alpine to 590.0.1-alpine: #​1297
  • build(deps): bump ubi from ubi8 8.2 to ubi9 9.8: #​1295
  • build(deps): bump rabbitmq from 3.7.11 to 4.4.0: #​1296
Fork Related

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • Between 12:00 AM and 05:59 AM, only on Monday (* 0-5 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker.io/library/python](https://hub.docker.com/_/python) ([source](https://github.com/docker-library/python)) | container | minor | `3.12-slim-bookworm` → `3.15-slim-bookworm` | | [ghcr.io/osscontainertools/kaniko](https://github.com/osscontainertools/kaniko) | container | minor | `v1.28.6-debug` → `v1.29.0-debug` | | [python](https://hub.docker.com/_/python) ([source](https://github.com/docker-library/python)) | final | minor | `3.12-slim-bookworm` → `3.15-slim-bookworm` | | [python](https://hub.docker.com/_/python) ([source](https://github.com/docker-library/python)) | stage | minor | `3.12-slim-bookworm` → `3.15-slim-bookworm` | --- ### Release Notes <details> <summary>osscontainertools/kaniko (ghcr.io/osscontainertools/kaniko)</summary> ### [`v1.29.0`](https://github.com/osscontainertools/kaniko/blob/HEAD/CHANGELOG.md#v1290-Release-2026-10-25) [Compare Source](https://github.com/osscontainertools/kaniko/compare/v1.28.6...v1.29.0) #### Update Notice > ⚠️ The `slim` image no longer authenticates to GCR/GAR, ECR and ACR, and drops the `gs://`, `s3://` and azure build contexts, git build contexts and OpenTelemetry export. If you use any of them, switch to `latest`, which is now about the same size as `slim` used to be. In this Release we activated these feature-flags: - [FF_KANIKO_ADD_CHECKSUM](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_add_checksum) - [FF_KANIKO_ADD_UNPACK](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_add_unpack) - [FF_KANIKO_CACHE_HASH_BLAKE3](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_cache_hash_blake3) - [FF_KANIKO_CACHE_LOOKAHEAD](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_cache_lookahead) - [FF_KANIKO_COPY_SKIP_SPECIAL_FILES](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_copy_skip_special_files) - [FF_KANIKO_CROSS_REPO_MOUNT](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_cross_repo_mount) - [FF_KANIKO_DEPRECATE_LAYERLESS_CACHE_ENTRIES](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_deprecate_layerless_cache_entries) - [FF_KANIKO_EXPAND_HEREDOC](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_expand_heredoc) - [FF_KANIKO_HASH_DIR_FRAMING](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_hash_dir_framing) - [FF_KANIKO_IMAGE_STAGES](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_image_stages) - [FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_infer_cross_stage_cache_key) - [FF_KANIKO_LAYER_HINTS](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_layer_hints) - [FF_KANIKO_NATIVE_COPY](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_native_copy) - [FF_KANIKO_PATH_SCOPED_REGISTRY_AUTH](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_path_scoped_registry_auth) - [FF_KANIKO_PEEK_ARCHIVE_HEADER](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_peek_archive_header) - [FF_KANIKO_PLATFORM_CACHE_KEY](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_platform_cache_key) - [FF_KANIKO_POOL_REGISTRY_CONNECTIONS](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_pool_registry_connections) - [FF_KANIKO_PRECOMPILE_DOCKERIGNORE](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_precompile_dockerignore) - [FF_KANIKO_PRESERVE_MOUNTED_SYMLINKS](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_preserve_mounted_symlinks) - [FF_KANIKO_REPRODUCIBLE_PRESERVE_BASE_LAYERS](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_reproducible_preserve_base_layers) - [FF_KANIKO_REPRODUCIBLE_PRESERVE_FORMAT](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_reproducible_preserve_format) - [FF_KANIKO_RESOLVE_CACHE_KEY](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_resolve_cache_key) - [FF_KANIKO_ROLLING_CACHE_KEY](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_rolling_cache_key) - [FF_KANIKO_RUN_HONOR_GROUP](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_run_honor_group) - [FF_KANIKO_SHARED_BASE_CACHE](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_shared_base_cache) - [FF_KANIKO_SKIP_CACHED_STAGES](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_skip_cached_stages) - [FF_KANIKO_SKIP_RELABEL_RECOMPRESS](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_skip_relabel_recompress) - [FF_KANIKO_SKIP_WRITE_WHITEOUTS](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_skip_write_whiteouts) - [FF_KANIKO_UNPACK_ZSTD](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_unpack_zstd) - [FF_KANIKO_UNTAR_SKIP_ROOT](https://github.com/osscontainertools/kaniko#flag-ff_kaniko_untar_skip_root) > ⚠️ Several of these flags change how cache keys are computed. Existing cache entries are invalidated, so the first build after upgrading is a full rebuild that repopulates the cache. > ⚠️ `--reproducible` now leaves base layers untouched and keeps the requested image format, so the digest of a reproducible build changes once. A reproducible build from an OCI base is now pushed as OCI instead of docker, pass `--image-format=docker` to keep the old format. `FF_KANIKO_ADD_CHECKSUM` verifies `ADD --checksum`. A wrong checksum used to pass silently and now fails the build, so update it to the digest of the download. `FF_KANIKO_EXPAND_HEREDOC` expands variables in unquoted `COPY` and `ADD` heredoc bodies. If a body needs a literal `$`, quote the delimiter: ```dockerfile COPY <<'EOF' /etc/motd costs $5 EOF ``` `FF_KANIKO_PATH_SCOPED_REGISTRY_AUTH` matches an `auths` entry against the repository namespace, so one entry for `registry.example.com/org-a` covers every repository below it and you can merge your per-repository entries. It is no longer sent to sibling namespaces like `registry.example.com/org-b`, which now need their own entry. `FF_KANIKO_SHARED_BASE_CACHE` keeps downloaded bases in `/kaniko/bases` after the build, `--cleanup` does not remove them. If you reuse an executor for many builds, clean that directory yourself. You can roll-back any of those changes by overriding them in the environment ie. ```yaml job: variables: FF_KANIKO_PLATFORM_CACHE_KEY: "0" FF_KANIKO_CROSS_REPO_MOUNT: "0" ``` Please also notify us by [filing a new issue](https://github.com/osscontainertools/kaniko/issues/new/choose). We further removed these feature-flags: - `FF_KANIKO_RUN_MOUNT_BIND` - `FF_KANIKO_NO_PROPAGATE_ANNOTATIONS` - `FF_KANIKO_VOLUME_SKIP_MKDIR` - `FF_KANIKO_PRESERVE_HARDLINKS` - `FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE` - `FF_KANIKO_PRESERVE_MOUNTED_PATHS` - `FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE` - `FF_KANIKO_SECUREJOIN_EXTRACTION` - `FF_KANIKO_WARMER_CACHE_LOCK` - `FF_KANIKO_CLEAN_KANIKO_DIR` - `FF_KANIKO_RELATIVE_LINK_TARGETS` - `FF_KANIKO_OCI_WARMER` - `FF_KANIKO_IGNORE_CACHED_MANIFEST` Their behavior is now unconditional, they have no effect and can be removed. > ⚠️ The warmer only reads and writes the OCI layout now. Tarballs left in a warmer cache from before `v1.28.0` are no longer used, re-run the warmer to populate the cache. #### Community Update [@&#8203;gary-wall](https://github.com/gary-wall) made their first contribution in [#&#8203;1205](https://github.com/osscontainertools/kaniko/pull/1205). The warmer now also caches the image index, so builds from a base pinned by index digest work air-gapped. [@&#8203;gary-wall](https://github.com/gary-wall) also joined us as a maintainer, welcome aboard! Also many thanks to [@&#8203;philou-078](https://github.com/philou-078) and [@&#8203;hanbyeol](https://github.com/hanbyeol) for reporting issues fixed in this release. To get an overview over our feature flags you can check the schedule on <https://osscontainertools.org/kaniko/flags/> #### What's Changed ##### Security - go stdlib v1.26.9: CVE-2026-111943 (eMudhra) ##### Bugfixes - warmer pulls `scratch` from the registry: by [@&#8203;gary-wall](https://github.com/gary-wall) in [#&#8203;1205](https://github.com/osscontainertools/kaniko/pull/1205) - `FF_KANIKO_ISOLATE_CACHE_PUSH=false` every cache push also writes the build outputs: [#&#8203;1223](https://github.com/osscontainertools/kaniko/pull/1223) - warmer leaves nested `ARG` defaults unexpanded: [#&#8203;1209](https://github.com/osscontainertools/kaniko/pull/1209) - `FF_KANIKO_WARMER_BUILD_ARGS=false` warmer lets an `ARG` default win over `--build-arg`: [#&#8203;1207](https://github.com/osscontainertools/kaniko/pull/1207) - warmer pulls stage references that differ in case: [#&#8203;1208](https://github.com/osscontainertools/kaniko/pull/1208) - `FF_KANIKO_WARMER_PREDEFINED_ARGS=false` warmer leaves `TARGETARCH` empty in `FROM`: [#&#8203;1210](https://github.com/osscontainertools/kaniko/pull/1210) ##### Standardization - `FF_KANIKO_RUN_HEREDOC_SCRIPT=false` run a lone `RUN` heredoc body as the script: [#&#8203;1216](https://github.com/osscontainertools/kaniko/pull/1216) - `FF_KANIKO_COPY_KEEP_DEST_OWNER=false` `COPY --chown` keeps the owner of an existing destination directory: [#&#8203;1257](https://github.com/osscontainertools/kaniko/pull/1257) - `FF_KANIKO_COPY_SUBDIR_MODE=false` directory `COPY` applies the source mode to existing subdirectories: [#&#8203;1259](https://github.com/osscontainertools/kaniko/pull/1259) ##### Caching - `FF_KANIKO_CACHE_IMAGE_INDEX=false` warmer caches the image index of index-pinned bases: by [@&#8203;gary-wall](https://github.com/gary-wall) in [#&#8203;1225](https://github.com/osscontainertools/kaniko/pull/1225) - `FF_KANIKO_FORMAT_INDEPENDENT_CACHE_KEY=false` keep `--image-format` out of cache keys: [#&#8203;1276](https://github.com/osscontainertools/kaniko/pull/1276) ##### Performance - relabel cached layers without downloading them: [#&#8203;1275](https://github.com/osscontainertools/kaniko/pull/1275) ##### Usability - warmer `--dryrun` prints which bases it would fetch: [#&#8203;1206](https://github.com/osscontainertools/kaniko/pull/1206) - graduate feature flags for v1.29.0 release: [#&#8203;870](https://github.com/osscontainertools/kaniko/pull/870) [#&#8203;1235](https://github.com/osscontainertools/kaniko/pull/1235) - `--predefined-annotations` sets the OCI source, revision, version and base image annotations: [#&#8203;1227](https://github.com/osscontainertools/kaniko/pull/1227) - `--provenance` attaches a SLSA provenance attestation: [#&#8203;1230](https://github.com/osscontainertools/kaniko/pull/1230) - `FF_KANIKO_NATIVE_INIT=false` kaniko acts as its own init process: [#&#8203;1222](https://github.com/osscontainertools/kaniko/pull/1222) ##### Telemetry - trace the push, planning and the `--reproducible` rewrite: [#&#8203;1217](https://github.com/osscontainertools/kaniko/pull/1217) ##### Packaging - make the kaniko images reproducible: [#&#8203;1231](https://github.com/osscontainertools/kaniko/pull/1231) - ship licenses in the images: [#&#8203;1247](https://github.com/osscontainertools/kaniko/pull/1247) - ship credential helpers as hardlinks to the executor: [#&#8203;1224](https://github.com/osscontainertools/kaniko/pull/1224) - add busybox and tini sources to the SBOM: [#&#8203;1246](https://github.com/osscontainertools/kaniko/pull/1246) - reproducible go build of executor and warmer: by [@&#8203;gary-wall](https://github.com/gary-wall) in [#&#8203;1269](https://github.com/osscontainertools/kaniko/pull/1269) - `slim` image drops the cloud SDKs, go-git and OpenTelemetry: [#&#8203;1279](https://github.com/osscontainertools/kaniko/pull/1279) [#&#8203;1265](https://github.com/osscontainertools/kaniko/pull/1265) ##### Maintenance - build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.3 to 1.66.6: [#&#8203;1215](https://github.com/osscontainertools/kaniko/pull/1215) [#&#8203;1255](https://github.com/osscontainertools/kaniko/pull/1255) [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecrpublic from 1.47.3 to 1.47.6: [#&#8203;1215](https://github.com/osscontainertools/kaniko/pull/1215) [#&#8203;1255](https://github.com/osscontainertools/kaniko/pull/1255) [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3: [#&#8203;1226](https://github.com/osscontainertools/kaniko/pull/1226) - build(deps): bump github.com/klauspost/cpuid/v2 from 2.4.0 to 2.4.1: [#&#8203;1228](https://github.com/osscontainertools/kaniko/pull/1228) - build(deps): bump google.golang.org/api from 0.301.0 to 0.308.0: [#&#8203;1229](https://github.com/osscontainertools/kaniko/pull/1229) [#&#8203;1245](https://github.com/osscontainertools/kaniko/pull/1245) [#&#8203;1256](https://github.com/osscontainertools/kaniko/pull/1256) [#&#8203;1264](https://github.com/osscontainertools/kaniko/pull/1264) [#&#8203;1283](https://github.com/osscontainertools/kaniko/pull/1283) - build(deps): bump go from 1.26.9 to 1.27.3: [#&#8203;1034](https://github.com/osscontainertools/kaniko/pull/1034) [#&#8203;1271](https://github.com/osscontainertools/kaniko/pull/1271) - build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.1 to 1.15.0: [#&#8203;1244](https://github.com/osscontainertools/kaniko/pull/1244) - build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.31.0 to 2.32.0: [#&#8203;1243](https://github.com/osscontainertools/kaniko/pull/1243) - build(deps): bump github.com/docker/cli from 29.9.0 to 29.9.2: [#&#8203;1242](https://github.com/osscontainertools/kaniko/pull/1242) [#&#8203;1255](https://github.com/osscontainertools/kaniko/pull/1255) - build(deps): bump github.com/Microsoft/go-winio from 0.6.3 to 0.6.4: [#&#8203;1242](https://github.com/osscontainertools/kaniko/pull/1242) - build(deps): bump github.com/moby/buildkit from 0.34.0 to 0.34.1: [#&#8203;1249](https://github.com/osscontainertools/kaniko/pull/1249) - build(deps): bump step-security/harden-runner from 2.22.1 to 2.22.2: [#&#8203;1253](https://github.com/osscontainertools/kaniko/pull/1253) - build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.16 to 0.4.19: [#&#8203;1255](https://github.com/osscontainertools/kaniko/pull/1255) [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump anchore/grype from 0.111.1 to 0.121.0: [#&#8203;1261](https://github.com/osscontainertools/kaniko/pull/1261) - build(deps): bump k3s-io/k3s from v1.36.2+k3s1 to v1.37.1+k3s1: [#&#8203;1262](https://github.com/osscontainertools/kaniko/pull/1262) [#&#8203;1286](https://github.com/osscontainertools/kaniko/pull/1286) - build(deps): bump docker engine from 29.7.0 to 29.9.2: [#&#8203;1260](https://github.com/osscontainertools/kaniko/pull/1260) - build(deps): bump alpine from 3.24.2 to 3.24.3: [#&#8203;1270](https://github.com/osscontainertools/kaniko/pull/1270) - build(deps): bump docker/login-action from 4.6.0 to 4.7.0: [#&#8203;1272](https://github.com/osscontainertools/kaniko/pull/1272) - build(deps): bump docker/setup-docker-action from 5.5.0 to 5.6.0: [#&#8203;1272](https://github.com/osscontainertools/kaniko/pull/1272) - build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.10: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.5: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/docker/docker-credential-helpers from 0.9.10 to 0.9.12: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.7.22 to 1.7.24: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.9 to 1.20.10: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.20.3 to 1.20.4: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/internal/configsources from 1.5.6 to 1.5.7: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 from 2.8.6 to 2.8.7: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/internal/v4a from 1.5.6 to 1.5.7: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from 1.13.21 to 1.13.22: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/checksum from 1.11.7 to 1.11.8: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/presigned-url from 1.14.6 to 1.14.7: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/s3shared from 1.20.6 to 1.20.7: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/signin from 1.10.4 to 1.10.5: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sso from 1.38.4 to 1.38.5: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/ssooidc from 1.43.4 to 1.43.5: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts from 1.51.4 to 1.51.5: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/aws/smithy-go from 1.28.5 to 1.28.6: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/googleapis/enterprise-certificate-proxy from 0.3.23 to 0.3.24: [#&#8203;1274](https://github.com/osscontainertools/kaniko/pull/1274) - build(deps): bump github.com/ProtonMail/go-crypto from 1.4.1 to 1.5.2: [#&#8203;1184](https://github.com/osscontainertools/kaniko/pull/1184) - build(deps): bump github.com/googleapis/gax-go/v2 from 2.26.2 to 2.27.0: [#&#8203;1282](https://github.com/osscontainertools/kaniko/pull/1282) - build(deps): bump github.com/dimchansky/utfbom from 1.1.1 to 1.2.0: [#&#8203;1281](https://github.com/osscontainertools/kaniko/pull/1281) - build(deps): bump github.com/osscontainertools/docker-credential-acr from 0.9.2 to 1.0.0: [#&#8203;1284](https://github.com/osscontainertools/kaniko/pull/1284) - build(deps): bump registry from 2 to 3: [#&#8203;1288](https://github.com/osscontainertools/kaniko/pull/1288) - build(deps): bump google/cloud-sdk from 256.0.0-alpine to 590.0.1-alpine: [#&#8203;1297](https://github.com/osscontainertools/kaniko/pull/1297) - build(deps): bump ubi from ubi8 8.2 to ubi9 9.8: [#&#8203;1295](https://github.com/osscontainertools/kaniko/pull/1295) - build(deps): bump rabbitmq from 3.7.11 to 4.4.0: [#&#8203;1296](https://github.com/osscontainertools/kaniko/pull/1296) ##### Fork Related - drop unused dependencies and upstream leftovers: [#&#8203;1237](https://github.com/osscontainertools/kaniko/pull/1237) [#&#8203;1239](https://github.com/osscontainertools/kaniko/pull/1239) [#&#8203;1240](https://github.com/osscontainertools/kaniko/pull/1240) [#&#8203;1278](https://github.com/osscontainertools/kaniko/pull/1278) - test improvements: [#&#8203;1238](https://github.com/osscontainertools/kaniko/pull/1238) [#&#8203;1273](https://github.com/osscontainertools/kaniko/pull/1273) [#&#8203;1289](https://github.com/osscontainertools/kaniko/pull/1289) [#&#8203;1290](https://github.com/osscontainertools/kaniko/pull/1290) [#&#8203;1293](https://github.com/osscontainertools/kaniko/pull/1293) [#&#8203;1292](https://github.com/osscontainertools/kaniko/pull/1292) [#&#8203;1299](https://github.com/osscontainertools/kaniko/pull/1299) [#&#8203;1294](https://github.com/osscontainertools/kaniko/pull/1294) [#&#8203;1298](https://github.com/osscontainertools/kaniko/pull/1298) [#&#8203;1291](https://github.com/osscontainertools/kaniko/pull/1291) - `--dryrun` plan prints `STREAM` for `FROM scratch`: [#&#8203;1211](https://github.com/osscontainertools/kaniko/pull/1211) - `KANIKO_NO_PUSH=true` without `--destination` fails flag validation: [#&#8203;1232](https://github.com/osscontainertools/kaniko/pull/1232) - disable the dependabot cooldown: [#&#8203;1267](https://github.com/osscontainertools/kaniko/pull/1267) - add [@&#8203;gary-wall](https://github.com/gary-wall) to maintainers: [#&#8203;1277](https://github.com/osscontainertools/kaniko/pull/1277) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - Between 12:00 AM and 05:59 AM, only on Monday (`* 0-5 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzguNSIsInVwZGF0ZWRJblZlciI6IjQ0LjE3OC41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Update all non-major dependencies
All checks were successful
CI / python (pull_request) Successful in 3m57s
Details
e82ab2b308
dawid force-pushed renovate/all-minor-patch from e82ab2b308
All checks were successful
CI / python (pull_request) Successful in 3m57s
Details
to 2accf97084
All checks were successful
CI / python (pull_request) Successful in 2m18s
Details
2026-11-03 09:36:47 +00:00 Compare
renovate-bot commented 2026-11-06 18:27:36 +00:00
Author
Collaborator

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

### Edited/Blocked Notification Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠️ **Warning**: custom changes will be lost.
All checks were successful
CI / python (pull_request) Successful in 2m18s
Details
This pull request has changes conflicting with the target branch.
  • .forgejo/workflows/ci.yml
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin 'renovate/all-minor-patch:renovate/all-minor-patch'
git switch 'renovate/all-minor-patch'

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch 'main'
git merge --no-ff 'renovate/all-minor-patch'
git switch 'renovate/all-minor-patch'
git rebase 'main'
git switch 'main'
git merge --ff-only 'renovate/all-minor-patch'
git switch 'renovate/all-minor-patch'
git rebase 'main'
git switch 'main'
git merge --no-ff 'renovate/all-minor-patch'
git switch 'main'
git merge --squash 'renovate/all-minor-patch'
git switch 'main'
git merge --ff-only 'renovate/all-minor-patch'
git switch 'main'
git merge 'renovate/all-minor-patch'
git push origin 'main'
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
dawid/nextcloud-harvester!2
No description provided.