Skip to content

chore(deps): update all non-major dependencies - #143

Merged
gusfcarvalho merged 2 commits into
mainfrom
renovate/all-non-major
Oct 29, 2026
Merged

chore(deps): update all non-major dependencies#143
gusfcarvalho merged 2 commits into
mainfrom
renovate/all-non-major

Conversation

@ccf-release-bot

@ccf-release-bot ccf-release-bot Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
cloudcustodian/c7n final patch 0.9.49.0 → 0.9.52.0
debian final pinDigest → 99c0b25
gcr.io/distroless/base-debian12 final pinDigest → fabbf1c
go (source) toolchain minor 1.26.10 → 1.27.3
golang (source) stage minor 1.26.10 → 1.27.3

Release Notes

cloud-custodian/cloud-custodian (cloudcustodian/c7n)

v0.9.52.0

Compare Source

What's Changed

AWS
Azure
GCP
Core
Tencentcloud
Tools
Releng
Docs
Schema Changes

New Contributors

Full Changelog: cloud-custodian/cloud-custodian@0.9.51.0...0.9.52.0

v0.9.51.0

Compare Source

What's Changed

AWS
Azure
GCP
Releng
Docs
Tests
Schema Changes

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@coderabbitai

coderabbitai Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 7a70bf81-b622-43ab-93ab-8a20a9cb37b7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@ccf-lisa @claude
style: gofmt generated proto for Go 1.27
135545f 
Go 1.27's gofmt aligns trailing comments differently, and the toolchain
bump in this PR makes ci / go run it. Whitespace-only change to the
generated runner/proto/types.pb.go.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ccf-lisa

ccf-lisa Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

Pushed 135545f (style: gofmt generated proto for Go 1.27) onto this branch: Go 1.27's gofmt aligns trailing comments differently, so the toolchain bump here makes ci / go reject the generated runner/proto/types.pb.go. Go 1.26's and 1.27's gofmt each reject the other's output, so the whitespace-only reformat has to land in the same PR as the bump. Checked locally under go1.27.3: gofmt -l . clean, go mod tidy no diff, go test ./... passes.

Because someone other than Renovate committed here, Renovate will stop rebasing this branch. That's fine: it auto-merges once green. If it ever needs a refresh, close it (or tick the rebase box) and Renovate will recreate it, and the gofmt commit would need re-applying.

🤖 Generated with Claude Code

@ccf-lisa ccf-lisa Bot mentioned this pull request Oct 29, 2026
Merged
gusfcarvalho
gusfcarvalho approved these changes Oct 29, 2026
View reviewed changes

@gusfcarvalho gusfcarvalho left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved: go1.27.3 toolchain + golang 1.27.3, c7n 0.9.52.0, digest pins; generated proto re-gofmt'd for Go 1.27. required is green.

@gusfcarvalho
gusfcarvalho merged commit b7a798d into main Oct 29, 2026
16 of 18 checks passed
@gusfcarvalho
gusfcarvalho deleted the renovate/all-non-major branch October 29, 2026 10:26
ccf-lisa Bot added a commit that referenced this pull request Oct 29, 2026
@ccf-lisa @claude
Merge origin/main into fix/static-images
511f32c 
Brings in #143 (Go toolchain go1.27.3, golang:1.27.3 builders, c7n 0.9.52.0,
digest-pinned base images, types.pb.go re-gofmt'd for Go 1.27).

Conflict in Dockerfile's final stage: keeps this PR's
gcr.io/distroless/static-debian12 digest pin and drops main's
base-debian12 pin, since the agent is now built with CGO_ENABLED=0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gusfcarvalho pushed a commit that referenced this pull request Oct 29, 2026
@ccf-lisa @claude
fix(docker): build agent static on distroless/static and patch the cu…
8725824 
…stodian image (#144)

Makes all three images pass CI's image check (no fixable HIGH or
CRITICAL finding).

## What changed

**agent** (`Dockerfile`)
- Builds `concom` with `CGO_ENABLED=0`, as `.goreleaser.yaml` already
does. The agent has no `import "C"` and no sqlite, and CCF's plugins are
built `CGO_ENABLED=0` too.
- Final stage moves from `gcr.io/distroless/base-debian12` to
`gcr.io/distroless/static-debian12:latest@sha256:d75cdd72…`. A static Go
binary never loads libssl, and distroless/static has no libc or libssl.
That removes the 5 libssl3 3.0.20 findings, which Google hasn't rebuilt
base-debian12 to fix.
- `WORKDIR /app`, `/app/concom` and `CMD` are unchanged, so agent-action
can still copy `/app/concom` out of this image. The image still runs as
root, as before.

**agent-custodian** (`Dockerfile-custodian`)
- Bumps c7n to `0.9.52.0@sha256:44cb9106…`. This is the same line as
Renovate's #143.
- c7n's image has a uv-managed venv (`/src/.venv`) and no pip. A `RUN
--mount=from=ghcr.io/astral-sh/uv:0.13.6@sha256:…` (Renovate tracks this
form) upgrades only the flagged packages to their fixed versions:
`aiohttp==3.14.4`, `certifi==2026.10.19`, `oauthlib==4.0.0`,
`pyjwt==2.15.0` and `urllib3==2.8.0`. uv also moved `yarl` 1.24.5 to
1.25.1 for aiohttp. `certifi` is 10.19 rather than 10.18 because
PYSEC-2026-4320 lists 10.19 as the fix.
- Purges Ubuntu's `python3-pip-whl` and `python3-setuptools-whl`, which
hold the pip 24.0 and setuptools 68.1.2 findings. They are only the
ensurepip wheels for `python3 -m venv`, so the purge also removes
`python3-venv` and `python3.12-venv`. c7n's own venv is unaffected.
- `concom` is built `CGO_ENABLED=0`, so it no longer depends on the c7n
image's Ubuntu glibc, which is older than the Debian builder's. The
patch block comes after `COPY --from=builder` so that this file merges
cleanly with #143.
- Drop each pin once a c7n release ships that version or newer.

**agent-ci** (`Dockerfile-ci`): only adds `CGO_ENABLED=0`, so all three
images ship the same static binary. The base is unchanged.

## Image check (`image-scan check`, workflows main 6bcaa73, osv-scanner
v2.7.0), fixable HIGH/CRITICAL

| Image | main | this PR |
| --- | --- | --- |
| agent | 5 (libssl3) | **0** (1 other, unfixable) |
| agent-custodian | 32 on c7n 0.9.49.0 (18 on 0.9.52.0 unpatched) |
**0** (5 other: 3 MEDIUM, 1 LOW, 1 UNKNOWN) |
| agent-ci | 0 | **0** |

## Runtime checks (local docker builds)
- agent: the binary is `statically linked` (per `file`), and `concom
--help` runs in distroless/static. `concom download-plugin -s
ghcr.io/compliance-framework/plugin-local-ssh:latest` pulls over TLS
using distroless's CA bundle and Go's resolver. The downloaded plugin
runs in the same image and prints the "This binary is a plugin" banner.
- agent-custodian: runs as user `custodian`, as before. `custodian
version` prints 0.9.52 and `custodian validate` passes on a small AWS
policy. `custodian run --dryrun` runs under moto's `mock_aws` with no
network, and both policies match one resource each, the same as the
unpatched 0.9.52.0 image. `uv pip check` reports all installed packages
compatible (242). Every c7n provider loads (aws, azure, gcp, k8s, oci,
…), and so do `msal`, `requests_oauthlib` and `kubernetes`. `concom
--help` runs.
- agent-ci: `concom --help` runs.
- `gofmt -l .` is clean and `go test ./...` passes (go1.26.10 before the
merge, go1.27.3 after it). There are no Go changes. hadolint on the
custodian file reports only DL3066 (info) for `USER root`/`USER
custodian`, and the agent file's DL3006 warning on main is gone.

## Merged with main (after #143)
#143 has merged, and this branch now has main merged in (511f32c, a
merge commit). The one conflict was the final `FROM` line of
`Dockerfile`: the merge keeps this PR's `static-debian12` line and drops
#143's `base-debian12` digest pin. Everything else comes from main as
is: the `golang:1.27.3@sha256:…` builder lines, `toolchain go1.27.3`,
c7n `0.9.52.0@sha256:…` (already the same line here), the digest-pinned
`debian:bookworm-slim` in `Dockerfile-ci`, and the re-gofmt'd
`types.pb.go`. `CGO_ENABLED=0` stays on all three builds.

Re-checked after the merge, under go1.27.3: `gofmt -l .` is clean, `go
vet ./...` and `go test ./...` pass, and `go mod tidy` leaves no diff.
All three images rebuilt locally and `image-scan check` (workflows main
e5482ec) reports no fixable HIGH or CRITICAL finding for agent, agent-ci
and agent-custodian. `concom --help` runs in the agent image and
`custodian version` prints 0.9.52 in the custodian image.

## Before merging
Please run `stack-smoke.yml` on images built from this branch. The agent
image's base changed, and the custodian image's Python dependencies
moved, including oauthlib 3 to 4.

## Open questions for reviewers
- A third-party plugin linked dynamically against libc would no longer
run in the `agent` image. CCF's plugins are static, and `agent-ci`
(Debian) and `agent-custodian` (Ubuntu) still have libc. Is that
acceptable, or should it be called out in the release notes?

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: ccf-lisa[bot] <286799724+ccf-lisa[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gusfcarvalho gusfcarvalho gusfcarvalho approved these changes

Assignees

No one assigned

Labels

renovate:automerge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gusfcarvalho