feat(gha/allenporter/flux-local): update 8.1.0 ➼ 8.4.0

[tinfoild]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
allenporter/flux-local	action	minor	8.1.0 → 8.4.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

allenporter/flux-local (allenporter/flux-local)

v8.4.0

Compare Source

What's Changed

• chore(deps): update pre-commit hook ty to v0.0.49 by @​renovate[bot] in #​1121

Full Changelog: allenporter/flux-local@8.3.0...8.4.0

v8.3.0

Compare Source

What's Changed

• fix: have renovate pin github actions digests by @​bo0tzz in #​1100
• fix: guard strip_resource_attributes against non-dict spec.template by @​dbrkv in #​1099
• Add tests for helm template flags by @​neodejack in #​1098
• fix: if oci digest is set, dont pass helm version by @​tholinka in #​1103
• chore(deps): bump gitpython to >= 3.1.47 for CVEs by @​johanot in #​1104
• chore(deps): pin dependencies by @​renovate[bot] in #​1105
• chore(deps): update docker/metadata-action action to v6 by @​renovate[bot] in #​1117
• chore(deps): update docker/login-action action to v4 by @​renovate[bot] in #​1116
• chore(deps): update docker/build-push-action action to v7 by @​renovate[bot] in #​1115
• chore(deps): update codecov/codecov-action action to v6 by @​renovate[bot] in #​1113
• chore(deps): update astral-sh/setup-uv action to v8 by @​renovate[bot] in #​1112
• chore(deps): update actions/upload-pages-artifact action to v5 by @​renovate[bot] in #​1111
• chore(deps): update actions/configure-pages action to v6 by @​renovate[bot] in #​1109
• chore(deps): update actions/deploy-pages action to v5 by @​renovate[bot] in #​1110
• Apply cruft updates by @​allenporter in #​1106
• chore(deps): update mshick/add-pr-comment action to v3 by @​renovate[bot] in #​1120
• chore(deps): update docker/setup-buildx-action action to v4 by @​renovate[bot] in #​1118
• chore(deps): update codecov/codecov-action action to v7 by @​renovate[bot] in #​1122
• chore(deps): update docker/setup-qemu-action action to v4 by @​renovate[bot] in #​1119

New Contributors

• @​bo0tzz made their first contribution in #​1100
• @​dbrkv made their first contribution in #​1099
• @​tholinka made their first contribution in #​1103
• @​johanot made their first contribution in #​1104

Full Changelog: allenporter/flux-local@8.2.0...8.3.0

v8.2.0

Compare Source

What's Changed

• Add HelmChart resource support and enhance HelmRelease handling by @​mouchar in #​1066
• chore(deps): update docker.io/alpine/helm docker tag to v4 by @​renovate[bot] in #​1045
• chore(deps): update actions/checkout action to v6 - autoclosed by @​renovate[bot] in #​1044
• chore(deps): update peter-evans/create-pull-request action to v8 by @​renovate[bot] in #​1060
• feat: add ExternalArtifact as local source by @​jkotiuk in #​1056
• chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.14.11 by @​renovate[bot] in #​1071
• New updates detected with Cruft by @​github-actions[bot] in #​1076
• Update devcontainer to mcr.microsoft.com/devcontainers/python:3.14-bookworm by @​allenporter in #​1078
• Replace kubernetes-dashboard with headlamp in test repositories by @​allenporter in #​1079
• Avoid spwaning subprocesses to speed up tests by @​allenporter in #​1080
• Add additional subprocess caching to speed up tests by @​allenporter in #​1081
• Fix headlamp tests by @​allenporter in #​1082
• chore(deps): update dependency pip to v26 by @​renovate[bot] in #​1075
• chore(deps): update dependency mashumaro to v3.18 by @​renovate[bot] in #​1074
• Update renovate chart to use oci by @​allenporter in #​1086
• chore(deps): update dependency oras to v0.2.39 by @​renovate[bot] in #​1083
• chore(deps): update dependency ruff to v0.15.1 by @​renovate[bot] in #​1084
• chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.15.1 by @​renovate[bot] in #​1085
• Mark OCI charts as succeed when OCI is disabled. by @​allenporter in #​1087
• chore: Update Flux CLI version by @​onedr0p in #​1088
• chore(deps): update github artifact actions (major) by @​renovate[bot] in #​1089
• New updates detected with Cruft by @​github-actions[bot] in #​1096
• feat: add more helm template flags by @​neodejack in #​1092
• feat: Resolve HelmRelease chartRef to HelmChart resources by @​allenporter in #​1097

New Contributors

• @​jkotiuk made their first contribution in #​1056
• @​neodejack made their first contribution in #​1092

Full Changelog: allenporter/flux-local@8.1.0...8.2.0

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	6fc53f8
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/helmrelease/out00

[tinfoild]

kube/kustomization/out00

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 02:53 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5412 — feat(gha/allenporter/flux-local): update 8.1.0 ➼ 8.4.0
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 2 (transitive via GitPython)

---

Severity Summary

Severity	Count
CRITICAL	1
HIGH	1
MEDIUM / MODERATE	0
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	2

---

Results

Package: allenporter/flux-local

• Ecosystem: GitHub Actions (Python)
• Old version: 8.1.0 — VULNERABLE (2 CVEs via GitPython 3.1.45)
• New version: 8.4.0 — CLEAN (requires GitPython >= 3.1.47, pins 3.1.50)

Vulnerabilities in version 8.1.0

1. CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 — Severity: CRITICAL (CVSS 9.1)

   • Description: GitPython command injection via Git options bypass — Python kwargs bypass the unsafe-option blocklist, enabling RCE.
   • Affected versions: GitPython >= 3.1.30, < 3.1.47
   • Fixed in: GitPython 3.1.47
   • Sources: OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-42215 | GHSA-rpm5-65cw-6hj4
   • Status: ✅ Fixed in newer versions

2. CVE-2026-42284 / GHSA-x2qx-6953-8485 — Severity: HIGH (CVSS 8.1)

   • Description: GitPython unsafe option check validates multi_options before shlex.split transformation, enabling command injection.
   • Affected versions: GitPython >= 0, < 3.1.47
   • Fixed in: GitPython 3.1.47
   • Sources: OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-42284 | GHSA-x2qx-6953-8485
   • Status: ✅ Fixed in newer versions

Vulnerabilities in version 8.4.0

No direct vulnerabilities found. Requires GitPython >= 3.1.47 (pins 3.1.50), which addresses both CVEs above. Note: GitPython 3.1.50 still has some unfixed advisory-level issues (GHSA-2f96-g7mh-g2hx, GHSA-956x-8gvw-wg5v, GHSA-rwj8-pgh3-r573) that are outside flux-local's control and require future GitPython updates to resolve.

Changelog Security Highlights (8.1.0 → 8.4.0)

• v8.3.0 — Security fix: bumped GitPython from < 3.1.47 to >= 3.1.47 addressing CVE-2026-42215 and CVE-2026-42284 (PR chore(container): update image jank.ing/jjgadgets/mlc-llm to 8b460a3 #1104)
• v8.2.0 — Feature and dependency updates (no security-specific patches)
• v8.4.0 — Minor release (no security-specific patches)

---

Non-applicable findings (verified and excluded)

Finding	Severity	Reason not applicable
CVE-2026-44243 / GHSA-7545-fcxq-7j24	HIGH	Fixed in GitPython 3.1.48; flux-local 8.4.0 pins 3.1.50
CVE-2026-44244 / GHSA-v87r-6q3f-2j67	HIGH	Fixed in GitPython 3.1.49; flux-local 8.4.0 pins 3.1.50
GHSA-mv93-w799-cj2w	HIGH	Fixed in GitPython 3.1.50; flux-local 8.4.0 pins 3.1.50

---

Recommendations

• MERGE PRIORITY: CRITICAL — The old version (8.1.0) depends on GitPython 3.1.45, which exposes 1 CRITICAL (CVE-2026-42215, CVSS 9.1) and 1 HIGH (CVE-2026-42284, CVSS 8.1) vulnerability. Version 8.4.0 bumps the dependency requirement to GitPython >= 3.1.47 (pins 3.1.50), remediating both. No new vulnerabilities introduced by this update.
• Merge this PR promptly to close the active exposure to GitPython command injection CVEs.

---

⚠️ This comment was updated by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.