Merge branch 'main' into wolfictl-ec37f591-d5a0-47ec-aa82-0c4ca75e817d

Author: dnegreira

.pre-commit-config.yaml

@@ -43,4 +43,4 @@ repos:
       - id: check-merge-conflict
       - id: check-symlinks
       - id: detect-private-key
-        exclude: ^ruby-3\.0/0001-ruby-3\.0\.6-openssl-patch\.patch$
+        exclude: ^(ruby-3\.0/0001-ruby-3\.0\.6-openssl-patch\.patch|gitleaks\.yaml)$

apache-orc.yaml

@@ -1,7 +1,7 @@
 package:
   name: apache-orc
   version: "2.1.2"
-  epoch: 0
+  epoch: 1
   description: "the smallest, fastest columnar storage for Hadoop workloads"
   copyright:
     - license: Apache-2.0
@@ -10,7 +10,7 @@ environment:
   contents:
     packages:
       - build-base
-      - cmake
+      - cmake-3
       - lz4-dev
       - protobuf-dev
       - samurai

apache-tika-3.1/pombump-deps.yaml

@@ -1,14 +1,14 @@
 package:
-  name: apache-tika-3.1
-  version: "3.1.0"
-  epoch: 3
+  name: apache-tika-3.2
+  version: "3.2.0"
+  epoch: 0
   description: The Apache Tika toolkit detects and extracts metadata and text from over a thousand different file types (such as PPT, XLS, and PDF).
   copyright:
     - license: Apache-2.0
   dependencies:
     runtime:
       - dash-binsh
-      - openjdk-17-default-jvm
+      - openjdk-21-default-jvm
     provides:
       - apache-tika=${{package.full-version}}
 
@@ -25,20 +25,22 @@ environment:
       - libfontconfig1
       - libjpeg-turbo
       - maven
-      - openjdk-17-default-jdk
+      - openjdk-21-default-jdk
 
 pipeline:
-  - uses: git-checkout
+  - uses: fetch
     with:
-      repository: https://github.com/apache/tika
-      tag: ${{package.version}}
-      expected-commit: 25619272d2f615df4ad87e27e7c8dec576f37627
+      uri: https://downloads.apache.org/tika/${{package.version}}/tika-${{package.version}}-src.zip
+      expected-sha512: 3882a1c1e4dc38de6491b1b9cf686ec703e958a38f4d09821c422ecacdbc0f5c8490c511c9d3875b8e8bfe79176a3febf37e62dcf3897ec3e1f413b99955f218
+      extract: false
 
-  - uses: auth/maven
+  - runs: |
+      unzip tika-${{package.version}}-src.zip
+      mv tika-${{package.version}}/* .
+      rm tika-${{package.version}}-src.zip
+      rmdir tika-${{package.version}}
 
-  - uses: maven/pombump
-    with:
-      properties-file: pombump-properties.yaml
+  - uses: auth/maven
 
   - runs: |
       mvn clean install -am -DskipTests -Dossindex.skip
@@ -55,18 +57,17 @@ subpackages:
 
 update:
   enabled: true
-  github:
-    identifier: apache/tika
-    use-tag: true
-    tag-filter: 3.1.
+  release-monitor:
+    identifier: 15703
+    version-filter-contains: 3.2.
 
 test:
   environment:
     contents:
       packages:
         - curl
         - ${{package.name}}-compat
-        - openjdk-17-default-jvm
+        - openjdk-21-default-jvm
   pipeline:
     - uses: test/daemon-check-output
       with:

apache-tika-3.1/pombump-properties.yaml

@@ -0,0 +1,73 @@
+package:
+  name: apisix-ingress-controller
+  version: "1.8.4"
+  epoch: 0
+  description: APISIX Ingress Controller for Kubernetes.
+  copyright:
+    - license: Apache-2.0
+
+pipeline:
+  - uses: git-checkout
+    with:
+      expected-commit: 019d719ef421e97ab47e68c0f34724010b05f1e0
+      repository: https://github.com/apache/apisix-ingress-controller
+      tag: v${{package.version}}
+
+  - uses: go/bump
+    with:
+      deps: |-
+        golang.org/x/crypto@v0.35.0
+        golang.org/x/net@v0.38.0
+        golang.org/x/oauth2@v0.27.0
+        google.golang.org/grpc@v1.57.1
+
+  - uses: go/build
+    with:
+      packages: .
+      ldflags: |
+        -X=github.com/apache/apisix-ingress-controller/pkg/version._buildVersion=${{package.version}}
+        -X=github.com/apache/apisix-ingress-controller/pkg/version._buildGitRevision=$(git rev-parse --short HEAD)
+        -X=github.com/apache/apisix-ingress-controller/pkg/version._buildOS=$(uname -s)/$(uname -m)
+      output: apisix-ingress-controller
+
+subpackages:
+  - name: ${{package.name}}-compat
+    description: Compatibility package for apisix-ingress-controller to match upstream paths
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.subpkgdir}}/app
+          ln -sf /usr/bin/apisix-ingress-controller ${{targets.subpkgdir}}/app/apisix-ingress-controller
+    test:
+      pipeline:
+        - runs: |
+            stat /app/apisix-ingress-controller
+
+update:
+  enabled: true
+  github:
+    identifier: apache/apisix-ingress-controller
+    strip-prefix: v
+
+test:
+  environment:
+    contents:
+      packages:
+        - curl
+  pipeline:
+    - runs: |
+        set -o pipefail
+        apisix-ingress-controller version | grep "${{ package.version }}"
+        apisix-ingress-controller --help 2>&1 | grep -F -e "Yet another Ingress controller"
+    - uses: test/kwok/cluster
+    - uses: test/daemon-check-output
+      with:
+        setup: |
+          kubectl config view --minify --raw > /tmp/kubeconfig.yaml
+        start: |
+          apisix-ingress-controller ingress --default-apisix-cluster-base-url http://apisix-service:9180/apisix/admin --kubeconfig /tmp/kubeconfig.yaml
+        timeout: 30
+        expected_output: |
+          start leader election
+          start api server
+        post: |
+          curl -fsSL http://127.0.0.1:8080/metrics | grep -q go_gc_duration_seconds && echo "Metrics endpoint is live"

apache-tika-3.1.yaml renamed to apache-tika-3.2.yaml

@@ -1,7 +1,7 @@
 package:
   name: apko
-  version: "0.27.9"
-  epoch: 1
+  version: "0.28.0"
+  epoch: 0
   description: Build OCI images using APK directly without Dockerfile
   copyright:
     - license: Apache-2.0
@@ -14,7 +14,7 @@ pipeline:
     with:
       repository: https://github.com/chainguard-dev/apko
       tag: v${{package.version}}
-      expected-commit: 914a57446266dc29e612ebbc2669c1045625880d
+      expected-commit: 09497eb9ecf658a2b64184ca846ab2ce16711c4d
 
   - uses: go/build
     with:

apisix-ingress-controller.yaml

@@ -1,7 +1,7 @@
 package:
   name: argo-workflows
   version: "3.6.10"
-  epoch: 1
+  epoch: 2
   description: Workflow engine for Kubernetes.
   copyright:
     - license: Apache-2.0
@@ -30,6 +30,7 @@ pipeline:
     with:
       deps: |-
         github.com/cloudflare/circl@v1.6.1
+        github.com/go-viper/mapstructure/v2@v2.3.0
 
   - uses: patch
     with:

apko.yaml

@@ -1,20 +1,24 @@
-From d64bec425f46a6418f37a617f6ea63924f830f17 Mon Sep 17 00:00:00 2001
-From: Batuhan Apaydin <batuhan.apaydin@chainguard.dev>
-Date: Thu, 21 Nov 2024 14:54:20 +0300
-Subject: [PATCH] Bump Node Dependencies in argo-workflows UI
+From e479e53222b402c90e3e0d75b6323b84127f52a9 Mon Sep 17 00:00:00 2001
+From: Kyle Steere <kyle.steere@chainguard.dev>
+Date: Tue, 1 Jul 2025 10:13:14 -0500
+Subject: [PATCH] webpack-dev-server upgrade to 5.2.1 to fix
+ CVE-2025-30359,CVE-2025-30360
 
-Remedieate(CVE): GHSA-67mh-4wv8-2f99(upgrade-esbuild-to-0.25.0), GHSA-grv7-fg5c-xmjg(upgrade-braces-to-3.0.3)
-
-Signed-off-by: Batuhan Apaydin <batuhan.apaydin@chainguard.dev>
+Signed-off-by: Kyle Steere <kyle.steere@chainguard.dev>
 ---
- ui/package.json | 17 +++++++++++++++--
- 1 file changed, 15 insertions(+), 2 deletions(-)
+ ui/package.json | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
 
 diff --git a/ui/package.json b/ui/package.json
-index e103091..be5c2c9 100644
+index 36025e020..0322d81b7 100644
 --- a/ui/package.json
 +++ b/ui/package.json
-@@ -86,7 +86,21 @@
+@@ -82,11 +82,25 @@
+         "typescript": "^4.6.4",
+         "webpack": "^5.94.0",
+         "webpack-cli": "^5.1.4",
+-        "webpack-dev-server": "^4.15.0",
++        "webpack-dev-server": "^5.2.1",
          "yarn-deduplicate": "^6.0.2"
      },
      "resolutions": {
@@ -36,9 +40,6 @@ index e103091..be5c2c9 100644
 +            "path-to-regexp@1.8.0": "^1.9.0"
 +        }
      }
--}
-+}
-\ No newline at end of file
+ }
 -- 
-2.39.3 (Apple Git-146)
-
+2.43.0

argo-workflows.yaml

@@ -1,11 +1,17 @@
 package:
   name: automake
-  version: "1.18"
-  epoch: 1
+  version: "1.18.1"
+  epoch: 0
   description: "GNU tool for generating makefiles"
   copyright:
     - license: GPL-2.0
 
+var-transforms:
+  - from: ${{package.version}}
+    match: ^(\d+\.\d+).*
+    replace: $1
+    to: major-minor-version
+
 environment:
   contents:
     packages:
@@ -18,7 +24,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://ftpmirror.gnu.org/gnu/automake/automake-${{package.version}}.tar.xz
-      expected-sha256: 5bdccca96b007a7e344c24204b9b9ac12ecd17f5971931a9063bdee4887f4aaf
+      expected-sha256: 168aa363278351b89af56684448f525a5bce5079d0b6842bd910fdd3f1646887
 
   - runs: |
       M4=/usr/bin/m4 ./configure \
@@ -59,13 +65,13 @@ test:
     # AUTOGENERATED
     - runs: |
         aclocal --version
-        aclocal-${{package.version}} --version
+        aclocal-${{vars.major-minor-version}} --version
         automake --version
-        automake-${{package.version}} --version
+        automake-${{vars.major-minor-version}} --version
         aclocal --help
-        aclocal-${{package.version}} --help
+        aclocal-${{vars.major-minor-version}} --help
         automake --help
-        automake-${{package.version}} --help
+        automake-${{vars.major-minor-version}} --help
     - name: "Verify automake version"
       runs: |
         automake --version | grep -q "${{package.version}}"