chore(oci/charts/cloudnative-pg): pin 0.29.0 ➼ 209c588

[tinfoild]

This PR contains the following updates:

Package	Update	Change	OpenSSF
ghcr.io/cloudnative-pg/charts/cloudnative-pg (source)	pinDigest	→ 209c588

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	9447251
Status:	🚫  Build failed.

View logs

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 06:48 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5676 — chore(oci/charts/cloudnative-pg): pin 0.29.0 ➼ 209c588
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 0

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM / MODERATE	0
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	0

---

Results

Package: cloudnative-pg (Helm chart OCI)

• Ecosystem: OCI/Helm (operator image: ghcr.io/cloudnative-pg/cloudnative-pg)
• Old version: 0.29.0 (deploys operator 1.30.0) — CLEAN
• New version: 0.29.0 @ sha256:209c588 (deploys operator 1.30.0) — CLEAN

Vulnerabilities in version 0.29.0 (old)

No known vulnerabilities found. Operator 1.30.0 includes all known security patches.

Vulnerabilities in version 0.29.0 @ sha256:209c588 (new)

No known vulnerabilities found. Same operator version with digest pin for supply chain integrity.

Source scan summary

Source	Status	Notes
OSV.dev	✅ Scanned	308 Wolfi/Chainguard/CleanStart/MinimOS entries found for cloudnative-pg container OS packages — all reference Wolfi package versions, not applicable to Helm chart ecosystem
NVD	✅ Scanned	0 CVEs found for cloudnative-pg
GHSA	✅ Scanned	4 repo-level advisories found for cloudnative-pg/cloudnative-pg — all fixed in operator 1.30.0 (see details below)
GHSL	✅ Scanned	No GHSL publications found for cloudnative-pg
CISA KEV	✅ Scanned	No KEV entries for this product
FortiGuard	✅ Scanned	No FortiGuard advisories for this product
CVE.org	✅ Scanned	No CVEs found for this exact package name
Changelog	✅ Scanned	v1.30.0 includes 4 security fixes — already present in this version

Non-applicable findings (verified and excluded)

Finding	Severity	Reason not applicable
GHSA-x8c2-3p4r-v9r6 (CVE-2026-55769)	CRITICAL	search_path pinning; fixed in operator 1.28.4/1.29.2; 1.30.0 already includes the fix
GHSA-w3gf-xc94-wvmj (CVE-2026-55765)	HIGH	Cleartext password exposure; fixed in 1.28.4/1.29.2; 1.30.0 not affected
GHSA-423p-g724-fr39 (CVE-2026-44477)	CRITICAL	Metrics exporter RCE; fixed in 1.28.3/1.29.1; 1.30.0 not affected
GHSA-7qwx-x8ff-3px9	MEDIUM	Instance manager auth; fixed in 1.30.0 (this IS the patched version)
+304 OSV findings (CleanStart/MinimOS)	—	All reference Wolfi/Chainguard OS package versions, not the Helm chart ecosystem

Changelog Security Highlights — CloudNativePG operator 1.29.x → 1.30.0 (no version change; both run 1.30.0)

• CVE-2026-55769 / GHSA-x8c2-3p4r-v9r6 — CRITICAL: search_path pinning on operator-issued connections to prevent CWE-426 privilege escalation (in-pod RCE via COPY ... FROM PROGRAM)
• GHSA-7qwx-x8ff-3px9 — MEDIUM: Authenticated operator-to-instance-manager calls via ECDSA P-256 client certificates
• CVE-2026-55765 / GHSA-w3gf-xc94-wvmj — HIGH: SCRAM-SHA-256 password encoding to prevent cleartext capture in pg_stat_statements
• CVE-2026-44477 / GHSA-423p-g724-fr39 — CRITICAL: Metrics exporter SET ROLE bypass leading to PostgreSQL superuser escalation and OS RCE

---

Recommendations

• MERGE PRIORITY: LOW — No security vulnerabilities found in either version. Both old and new deploy CloudNativePG operator 1.30.0 which includes all known security patches.
• Security benefit: This PR adds digest pinning (sha256:209c588b...) for supply chain integrity, preventing tag mutability attacks. This is a security improvement in its own right, but does not address any new CVEs.
• Merge at your discretion; the digest pin is a recommended hardening practice.

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.