From 567bc8184ca39f28291ba0283a47faf549b504a7 Mon Sep 17 00:00:00 2001 From: Gonzalo Rojas Date: Mon, 14 Sep 2026 14:11:44 -0300 Subject: [PATCH] fix(deps): bump OpenTofu to 1.12.6 and Helm to 3.22.0 Both pinned builds use old Go toolchains, so Trivy flags their vendored stdlib and x/* modules. Measured against the published scopes/containers image: tofu 1.10.6 -> 1.12.6 54 findings -> 13 helm 3.15.4 -> 3.22.0 52 findings -> 0 Helm stays on the 3.x line, so no v4 migration. kubectl is deliberately left alone: no version below 1.37.0 clears its findings, and that is a seven-minor jump which breaks the supported skew against customer clusters. Co-Authored-By: Claude Opus 5 --- docker/containers.Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/containers.Dockerfile b/docker/containers.Dockerfile index 19d1d553..7bdf7e40 100644 --- a/docker/containers.Dockerfile +++ b/docker/containers.Dockerfile @@ -16,9 +16,9 @@ RUN apk add --no-cache aws-cli gomplate yq # Pinned binaries not reliably packaged on alpine: OpenTofu, kubectl, helm. # NOTE: review/pin these versions to what the scopes actually target. ARG TARGETARCH -ARG TOFU_VERSION=1.10.6 +ARG TOFU_VERSION=1.12.6 ARG KUBECTL_VERSION=1.30.4 -ARG HELM_VERSION=3.15.4 +ARG HELM_VERSION=3.22.0 RUN set -eux; \ curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_${TARGETARCH}.tar.gz" \ | tar -xz -C /usr/local/bin tofu; \