fix(helm/reloader): update 2.2.9 ➼ 2.2.14 by tinfoild[bot] · Pull Request #5431 · JJGadgets/Biohazard

tinfoild · 2026-04-13T18:31:37Z

This PR contains the following updates:

Package	Update	Change	OpenSSF
reloader	patch	`2.2.9` → `2.2.14`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Configuration

📅 Schedule: (in timezone Asia/Singapore)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

cloudflare-workers-and-pages · 2026-04-13T18:32:07Z

Deploying jjgadgets-biohazard with Cloudflare Pages

Latest commit:	`362ac67`
Status:	🚫 Build failed.

View logs

tinfoild · 2026-04-13T18:33:22Z

kube/kustomization/out00

--- kube/deploy/core/reloader/app Kustomization: flux-system/1-core-reloader-app HelmRelease: reloader/reloader

+++ kube/deploy/core/reloader/app Kustomization: flux-system/1-core-reloader-app HelmRelease: reloader/reloader

@@ -12,13 +12,13 @@

     spec:
       chart: reloader
       sourceRef:
         kind: HelmRepository
         name: stakater
         namespace: flux-system
-      version: 2.2.9
+      version: 2.2.14
   driftDetection:
     ignore:
     - paths:
       - /spec/replicas
     mode: warn
   install:

tinfoild · 2026-04-13T18:33:22Z

kube/kustomization/out00

--- kube/deploy/core/reloader/app Kustomization: flux-system/1-core-reloader-app HelmRelease: reloader/reloader

+++ kube/deploy/core/reloader/app Kustomization: flux-system/1-core-reloader-app HelmRelease: reloader/reloader

@@ -12,13 +12,13 @@

     spec:
       chart: reloader
       sourceRef:
         kind: HelmRepository
         name: stakater
         namespace: flux-system
-      version: 2.2.9
+      version: 2.2.10
   driftDetection:
     ignore:
     - paths:
       - /spec/replicas
     mode: warn
   install:

tinfoild · 2026-04-15T11:29:01Z

kube/helmrelease/out00

--- HelmRelease: reloader/reloader Deployment: reloader/reloader

+++ HelmRelease: reloader/reloader Deployment: reloader/reloader

@@ -13,13 +13,13 @@

     heritage: Helm
     app.kubernetes.io/managed-by: Helm
     egress.home.arpa/apiserver: allow
     egress.home.arpa/discord: allow
     group: com.stakater.platform
     provider: stakater
-    version: v1.4.14
+    version: v1.4.19
   name: reloader
   namespace: reloader
 spec:
   replicas: 2
   revisionHistoryLimit: 2
   selector:
@@ -36,13 +36,13 @@

         heritage: Helm
         app.kubernetes.io/managed-by: Helm
         egress.home.arpa/apiserver: allow
         egress.home.arpa/discord: allow
         group: com.stakater.platform
         provider: stakater
-        version: v1.4.14
+        version: v1.4.19
     spec:
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
           - weight: 100
             podAffinityTerm:
@@ -61,13 +61,13 @@

           matchLabels:
             app.kubernetes.io/name: reloader
         maxSkew: 1
         topologyKey: kubernetes.io/hostname
         whenUnsatisfiable: DoNotSchedule
       containers:
-      - image: ghcr.io/stakater/reloader:v1.4.14
+      - image: ghcr.io/stakater/reloader:v1.4.19
         imagePullPolicy: IfNotPresent
         name: reloader
         env:
         - name: GOMAXPROCS
           valueFrom:
             resourceFieldRef:

ciel-shieru · 2026-07-24T00:47:40Z

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 03:10 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5431 — fix(helm/reloader): update 2.2.9 ➼ 2.2.14
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 12

Severity Summary

Severity	Count
CRITICAL	1
HIGH	4
MEDIUM / MODERATE	7
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	12

Results

Package: reloader (stakater/Reloader)

Ecosystem: Go (Helm chart — bundled app image)
Old version: chart 2.2.9 / app v1.4.14 / Go 1.26
New version: chart 2.2.14 / app v1.4.19 / Go 1.26.4

Vulnerabilities in old version (chart 2.2.9 / app v1.4.14)

The old app image was compiled with Go 1.26 which lacks security fixes from Go 1.26.1 and 1.26.2. These are Go stdlib/compiler CVEs affecting the compiled binary.

CVE-2026-27143 — Severity: CRITICAL (CVSS 9.8)
- Compiler: loop induction variable underflow → memory corruption at runtime
- Affected: Go < 1.26.2
- Fixed in: Go 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-27143
CVE-2026-27140 — Severity: HIGH (CVSS 8.8)
- SWIG file smuggling via cgo → arbitrary code execution at build time
- Affected: Go < 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-27140
CVE-2026-33810 — Severity: HIGH (CVSS 8.2)
- crypto/x509: wildcard DNS SAN bypass in excluded constraints
- Affected: Go < 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-33810
CVE-2026-32283 — Severity: HIGH (CVSS 7.5)
- crypto/tls: TLS 1.3 key update → deadlock / resource exhaustion
- Affected: Go < 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-32283
CVE-2026-27144 — Severity: HIGH (CVSS 7.1)
- Compiler: memory corruption in no-op interface conversion optimization
- Affected: Go < 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-27144
CVE-2026-32282 — Severity: MEDIUM (CVSS 6.4)
- os: Root.Chmod follows symlinks outside root
- Affected: Go < 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-32282
CVE-2026-32289 — Severity: MEDIUM (CVSS 6.1)
- html/template: XSS via JS template literal context mismatch
- Affected: Go < 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-32289
CVE-2026-32288 — Severity: MEDIUM (CVSS 5.5)
- archive/tar: unbounded memory allocation via sparse map
- Affected: Go < 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-32288
CVE-2026-32280 — Severity: MEDIUM (CVSS 5.3)
- crypto/x509: excessive chain-building in Verify
- Affected: Go < 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-32280
CVE-2026-32281 — Severity: MEDIUM (CVSS 5.3)
- crypto/x509: quadratic policy validation
- Affected: Go < 1.26.2
- Sources: NVD, OSV
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-32281

+4 more Go 1.26.1 CVEs (CVE-2026-27138, CVE-2026-27137, CVE-2026-27142, CVE-2026-25679) — all fixed in Go 1.26.1+.

Vulnerabilities in new version (chart 2.2.14 / app v1.4.19)

CVE-2026-35469 / GHSA-pc3f-x583-g7j2 — Severity: MEDIUM (CVSS 6.5)
- spdystream v0.5.0: SPDY/3 frame parser OOM via crafted control frames
- Affected: spdystream < 0.5.1 (introduced in app v1.4.19; not present in v1.4.14)
- Fixed in: spdystream v0.5.1
- Sources: NVD, OSV, GHSA
- Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-35469 | GHSA-pc3f-x583-g7j2
- Status: ❌ Introduced in new version (upstream fix pending — PR Update module github.com/moby/spdystream to v0.5.1 [SECURITY] (master) stakater/Reloader#1173)

Changelog Security Highlights (chart 2.2.9 → 2.2.14)

app v1.4.16 — Go upgrade to 1.26.2 (fixes 10+ Go stdlib/compiler CVEs)
app v1.4.19 — go.mod updates & release script fixes; introduced spdystream v0.5.0 (CVE-2026-35469)
app v1.4.17 — Harden GitHub Actions workflows against cache poisoning
Other releases: feature additions and bug fixes, no security-specific patches

Non-applicable findings (verified and excluded)

Finding	Severity	Reason
CVE-2024-23656	HIGH (7.5)	Dex TLS-reloader issue — false positive from keyword match
CVE-2023-40297	HIGH (7.5)	Stakater Forecastle issue — different product
CLEANSTART-2026-PT11267	CRITICAL (9.8)	CleanStart build of reloader-fips — not upstream

Recommendations

MERGE PRIORITY: CRITICAL — The old app image (v1.4.14 / Go 1.26) has 1 CRITICAL and 4 HIGH-severity CVEs in Go stdlib/compiler, all remediated in the new image (Go 1.26.4).
Note: The new version introduces spdystream v0.5.0 (CVE-2026-35469, MEDIUM 6.5 — SPDY frame parser OOM). This is an indirect dependency; upstream fix PR (Update module github.com/moby/spdystream to v0.5.1 [SECURITY] (master) stakater/Reloader#1173) is open. Monitor for v0.5.1+ in a future update.
Merge this PR promptly to remediate the CRITICAL/HIGH exposure — the spdystream issue is lower severity and can be addressed in a follow-up.

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.

tinfoild Bot added kube/deploy/core renovate/datasource/helm renovate/type/patch labels Apr 13, 2026

tinfoild Bot force-pushed the renovate/reloader-2.2.x branch from 39cfcf5 to 97cd3c2 Compare April 15, 2026 11:27

tinfoild Bot changed the title ~~fix(helm/reloader): update 2.2.9 ➼ 2.2.10~~ fix(helm/reloader): update 2.2.9 ➼ 2.2.11 Apr 15, 2026

tinfoild Bot force-pushed the renovate/reloader-2.2.x branch 2 times, most recently from 1fc32ef to 536dac8 Compare April 27, 2026 11:43

tinfoild Bot force-pushed the renovate/reloader-2.2.x branch from 536dac8 to 3ab45bd Compare May 15, 2026 18:38

tinfoild Bot force-pushed the renovate/reloader-2.2.x branch from 3ab45bd to f1af44b Compare May 25, 2026 09:27

tinfoild Bot changed the title ~~fix(helm/reloader): update 2.2.9 ➼ 2.2.11~~ fix(helm/reloader): update 2.2.9 ➼ 2.2.12 May 25, 2026

tinfoild Bot force-pushed the renovate/reloader-2.2.x branch from f1af44b to 4a1461e Compare June 8, 2026 20:58

tinfoild Bot force-pushed the renovate/reloader-2.2.x branch from 4a1461e to dfa3c6b Compare June 19, 2026 12:30

tinfoild Bot force-pushed the renovate/reloader-2.2.x branch from dfa3c6b to 7177149 Compare July 1, 2026 11:10

tinfoild Bot changed the title ~~fix(helm/reloader): update 2.2.9 ➼ 2.2.12~~ fix(helm/reloader): update 2.2.9 ➼ 2.2.13 Jul 1, 2026

tinfoild Bot force-pushed the renovate/reloader-2.2.x branch from 7177149 to 6748d82 Compare July 1, 2026 15:05

tinfoild Bot changed the title ~~fix(helm/reloader): update 2.2.9 ➼ 2.2.13~~ fix(helm/reloader): update 2.2.9 ➼ 2.2.14 Jul 1, 2026

fix(helm/reloader): update 2.2.9 ➼ 2.2.14

362ac67

tinfoild Bot force-pushed the renovate/reloader-2.2.x branch from 6748d82 to 362ac67 Compare July 20, 2026 10:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(helm/reloader): update 2.2.9 ➼ 2.2.14 - #5431

fix(helm/reloader): update 2.2.9 ➼ 2.2.14#5431
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/reloader-2.2.x

tinfoild Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

tinfoild Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

tinfoild Bot commented Apr 13, 2026

Uh oh!

tinfoild Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

ciel-shieru commented Jul 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

tinfoild Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Configuration

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying jjgadgets-biohazard with Cloudflare Pages

Uh oh!

tinfoild Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

kube/kustomization/out00

Uh oh!

tinfoild Bot commented Apr 13, 2026

kube/kustomization/out00

Uh oh!

tinfoild Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

kube/helmrelease/out00

Uh oh!

ciel-shieru commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Severity Summary

Results

Package: reloader (stakater/Reloader)

Vulnerabilities in old version (chart 2.2.9 / app v1.4.14)

Vulnerabilities in new version (chart 2.2.14 / app v1.4.19)

Changelog Security Highlights (chart 2.2.9 → 2.2.14)

Non-applicable findings (verified and excluded)

Recommendations

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

tinfoild Bot commented Apr 13, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Apr 13, 2026 •

edited

Loading

tinfoild Bot commented Apr 13, 2026 •

edited

Loading

tinfoild Bot commented Apr 15, 2026 •

edited

Loading

ciel-shieru commented Jul 24, 2026 •

edited

Loading