feat(oci/vector): update 0.54.0 ➼ 0.59.0

[tinfoild]

This PR contains the following updates:

Package	Update	Change	OpenSSF
ghcr.io/vectordotdev/vector (source)	minor	0.54.0-distroless-libc → 0.59.0-distroless-libc

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	d753bfe
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/helmrelease/out00

--- HelmRelease: vector/vector Deployment: vector/vector

+++ HelmRelease: vector/vector Deployment: vector/vector

@@ -74,13 +74,13 @@

             fieldRef:
               fieldPath: spec.nodeName
         - name: PROM_HTTP
           value: '8081'
         - name: TZ
           value: null
-        image: ghcr.io/vectordotdev/vector:0.54.0-distroless-libc@sha256:2eb5350e821e77fc35a11a268e5cec4a1460134ddc75f3cb191a949739d36365
+        image: ghcr.io/vectordotdev/vector:0.59.0-distroless-libc@sha256:54a7c01056e98305fce80545ace22779035747af9e89114508330fe94f829831
         name: app
         ports:
         - containerPort: 8081
           name: metrics
         resources:
           limits:

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 05:10 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5570 — feat(oci/vector): update 0.54.0 ➼ 0.57.0
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 3

---

Severity Summary

Severity	Count
CRITICAL	1
HIGH	2
MEDIUM / MODERATE	0
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	3

---

Results

Package: ghcr.io/vectordotdev/vector

• Ecosystem: Docker / OCI container
• Old version: 0.54.0-distroless-libc — VULNERABLE (3 advisories)
• New version: 0.57.0-distroless-libc — CLEAN

Vulnerabilities in version 0.54.0

1. GHSA-6342-xwvw-c637 — Severity: CRITICAL

   • Description: Arbitrary file write in file sink via templated path traversal; untrusted event fields can write files outside intended directory, escalating to code execution (e.g., cron.d or authorized_keys).
   • Affected versions: >= 0.10.0, < 0.57.0
   • Fixed in: v0.57.0
   • Sources: GHSA
   • Evidence: GHSA-6342-xwvw-c637
   • Status: ✅ Fixed in newer versions

2. GHSA-qp6f-fpfx-4gg6 — Severity: HIGH

   • Description: Unauthenticated denial of service in the logstash source via nested compressed frames causing stack exhaustion and decompression amplification.
   • Affected versions: >= 0.15.0, < 0.57.0
   • Fixed in: 0.57.0
   • Sources: GHSA
   • Evidence: GHSA-qp6f-fpfx-4gg6
   • Status: ✅ Fixed in newer versions

3. GHSA-rrfg-9487-mhp6 — Severity: HIGH

   • Description: Unauthenticated denial of service in the logstash source via unbounded memory allocation triggered by a crafted compressed frame length field.
   • Affected versions: >= 0.15.0, < 0.57.0
   • Fixed in: 0.57.0
   • Sources: GHSA
   • Evidence: GHSA-rrfg-9487-mhp6
   • Status: ✅ Fixed in newer versions

Vulnerabilities in version 0.57.0

No known vulnerabilities found.

Changelog Security Highlights (0.54.0 → 0.57.0)

• v0.57.0 — Security-focused release: fixes CRITICAL arbitrary file write (GHSA-6342-xwvw-c637) and 2 HIGH DoS vulnerabilities (GHSA-qp6f-fpfx-4gg6, GHSA-rrfg-9487-mhp6) in the logstash and file sink.

---

Recommendations

• MERGE PRIORITY: CRITICAL — The old version (0.54.0) has 1 CRITICAL and 2 HIGH-severity vulnerabilities (arbitrary file write, unauthenticated DoS in logstash source). All three are remediated in 0.57.0. No new vulnerabilities introduced.
• v0.57.0 is explicitly a security-focused release — merge promptly to remediate the exposed vulnerabilities.
• Review breaking changes if you use the greptimedb_metrics/greptimedb_logs sinks (require GreptimeDB v1.x in 0.56.0) or the GraphQL API (moved to gRPC in 0.55.0).

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.

[tinfoild]

kube/kustomization/out00

--- kube/deploy/core/monitoring/vector/app Kustomization: flux-system/vector-app HelmRelease: vector/vector

+++ kube/deploy/core/monitoring/vector/app Kustomization: flux-system/vector-app HelmRelease: vector/vector

@@ -59,13 +59,13 @@

                   fieldRef:
                     fieldPath: spec.nodeName
               PROM_HTTP: 8081
               TZ: null
             image:
               repository: ghcr.io/vectordotdev/vector
-              tag: 0.54.0-distroless-libc@sha256:2eb5350e821e77fc35a11a268e5cec4a1460134ddc75f3cb191a949739d36365
+              tag: 0.58.0-distroless-libc@sha256:6c93dfe2554cc7e38316d618961cd657d5271c7a7aa727e0007502b28cb82c2e
             ports:
             - containerPort: 8081
               name: metrics
             resources:
               limits:
                 cpu: '1'