build(deps): bump the chainguard group across 1 directory with 2 updates

[dependabot]

Bumps the chainguard group with 2 updates in the / directory: chainguard.dev/apko and chainguard.dev/melange.

Updates chainguard.dev/apko from 1.2.35 to 1.2.44

Release notes

Sourced from chainguard.dev/apko's releases.

Release v1.2.44

Changelog

• c7be9d8f322bead447374ffded89174dd7457a9a apk: keep dir mode bits and ownership in the streaming install path (#2458)
• 8d2d137775ff3002505e2f68fe9d50bbb913d8c1 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.33 to 1.6.34 (#2457)
• 86b316045b227b6048c57c10d7933693fc824925 build(deps): bump chainguard.dev/sdk from 0.1.213 to 0.1.224 (#2445)
• f072627e166b3897a066793d4c267cca0f746ed5 build(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 (#2461)
• 9a2e920e8c91c30bfe3f178b290dc2c0a775f656 build(deps): bump go.opentelemetry.io/otel from 1.45.0 to 1.46.0 (#2446)
• 5292736e46c6bf1b378f3f67f8dc3218123861ed build(deps): bump google.golang.org/api from 0.293.0 to 0.294.0 (#2442)
• ceb4ac72e1b2d24f14c58c041ceb18a8684aae2b build(deps): bump google.golang.org/api from 0.294.0 to 0.295.0 (#2450)
• 65597e8cc5cf419d4eb2f8cce8d7a9d8d7b04ff7 build(deps): bump k8s.io/apimachinery from 0.36.4 to 0.37.0 (#2443)
• 3b95e3cf8861d658d177fb07af92247c22a6b8d2 build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 (#2452)
• 976de8dc15827c2b9c5bef372259192acbf55ae6 build(deps): bump the codeql group with 2 updates (#2447)
• 7359d026a4fa86c9ac8f51446803743efe13aef3 build(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#2453)
• dfdc7c0da737ee18c7ed060ad1fe700ea68a6fe8 build: honor pre-computed ELF metadata during ld.so.cache generation (#2454)
• 7ccff1f3f3f03a3468ff80a8340114e5aa66f6f7 erofs: restore multi-layer splitting, with the bugs review found fixed (#2418)
• 6b874b75f8c9d7121774f7a6e47c1c55006a992a erofs: share one inode per hardlink, and fix the stale mode-bit comments (#2422)
• 90f5dd7023e048a7ec5708398f4a0e70b591cbd7 erofs: small cleanups to erofsmount tool (#2426)

Release v1.2.43

Changelog

• 440957e31a268879fb52500c0bcca4fbd18270c2 apk: feed installation from an abstract PackageContents (#2441)
• eb2d36fedabb189e013e715a638f51fc8162c0d5 build: honor an explicitly empty pre-resolved set; refuse foreign-arc… (#2449)
• 94dfda0b6d5e3dd53b5bea3feba6fa2d33a0d356 build: install a pre-resolved package list from supplied contents (#2448)

Release v1.2.42

Changelog

• 7cb86096834d264cd5a8d006275201c6e5f45eb3 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.32 to 1.6.33 (#2438)
• 713d278889607519d2b66e1e5fe712ec598fccf3 build(deps): bump chainguard.dev/sdk from 0.1.212 to 0.1.213 (#2437)
• ac58b468d8b98b171d825fb4a0b6789390d8dd8d build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 (#2436)
• 055231b513c5df6f425703d7549df49e8fe6e88b sbom: make internal SPDX relationships reproducible (#2439)

Release v1.2.41

Changelog

• 326edceed8d0f8987cde35623be734eadf0cdcc3 apk: expose cache metrics (#2435)
• d7ffba39ce3a96739af261ced2300c4a9d861d55 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.31 to 1.6.32 (#2421)
• aeedd74f2113205a720e9c414df18ca1a21fb2c1 build(deps): bump chainguard.dev/sdk from 0.1.197 to 0.1.204 (#2425)
• c0b1316becd4928e7b7a4cb9122e3c9725fe0df3 build(deps): bump chainguard.dev/sdk from 0.1.204 to 0.1.210 (#2428)
• c89724f244e9d41f5e14cc7a5f3d0bd08a82128e build(deps): bump chainguard.dev/sdk from 0.1.210 to 0.1.212 (#2434)
• a2e35acdf791159eac2e1ef9e0b749af605e2535 build(deps): bump github.com/package-url/packageurl-go from 0.1.6 to 0.1.7 (#2430)
• e202915336e55f7d4b6f464f77bc334726d4c66b build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#2419)
• 5eab44e4b31ca569b6c08feda482ca3825934aae build(deps): bump go.step.sm/crypto from 0.88.0 to 0.89.0 (#2424)
• de11e492797f8f0094be458cf435aa4d4bd111fb build(deps): bump k8s.io/apimachinery from 0.36.3 to 0.36.4 (#2429)
• 1520c603b2f2df983f5ee06af19d0b87b41b41de build(deps): bump step-security/action-actionlint from 1.72.0 to 1.73.1 (#2420)
• 51d37b413dd5ab8d43f7ea888f701fc87088f517 build(deps): bump the codeql group with 2 updates (#2431)
• 883c5ad1e3036eebfb75efb5e554976db101493d fix(apk): stop racing on the shared indexOpts authenticator (#2432)
• 6a223c20c6c14015fdc9554e8ff385e22c5ac4fb go1.27 (#2427)

Release v1.2.40

Changelog

• d1b5d5ec7633ad7288e5841b38fc8103a9773436 erofs: add 'apko erofs mount' and 'apko erofs umount' (#2415)

... (truncated)

Commits

• f072627 build(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 (#2461)
• c7be9d8 apk: keep dir mode bits and ownership in the streaming install path (#2458)
• 8d2d137 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.33 to 1.6.34...
• 7359d02 build(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#2453)
• 3b95e3c build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 (#2452)
• 6b874b7 erofs: share one inode per hardlink, and fix the stale mode-bit comments (#2422)
• dfdc7c0 build: honor pre-computed ELF metadata during ld.so.cache generation (#2454)
• 7ccff1f erofs: restore multi-layer splitting, with the bugs review found fixed (#2418)
• 90f5dd7 erofs: small cleanups to erofsmount tool (#2426)
• ceb4ac7 build(deps): bump google.golang.org/api from 0.294.0 to 0.295.0 (#2450)
• Additional commits viewable in compare view

Updates chainguard.dev/melange from 0.59.0 to 0.59.5

Release notes

Sourced from chainguard.dev/melange's releases.

Release v0.59.5

What's Changed

• pre-commit: drop .git suffix from repo URL by @​xnox in chainguard-dev/melange#2644
• build(deps): bump the actions group across 1 directory with 3 updates by @​dependabot[bot] in chainguard-dev/melange#2640
• build: keep setuid/setgid/sticky on unpacked directories by @​smoser in chainguard-dev/melange#2646

Full Changelog: chainguard-dev/melange@v0.59.4...v0.59.5

Release v0.59.4

What's Changed

• git-checkout: disable git auto background maintenance by @​markusboehme in chainguard-dev/melange#2639
• sca: add support for new Chainguard Go 1.27 toolchains by @​xnox in chainguard-dev/melange#2643
• build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @​dependabot[bot] in chainguard-dev/melange#2638

New Contributors

• @​markusboehme made their first contribution in chainguard-dev/melange#2639

Full Changelog: chainguard-dev/melange@v0.59.3...v0.59.4

Release v0.59.3

What's Changed

• build(deps): bump the actions group with 2 updates by @​dependabot[bot] in chainguard-dev/melange#2626
• Upgrade to go1.27 by @​xnox in chainguard-dev/melange#2627
• build(deps): bump the gomod group across 1 directory with 3 updates by @​dependabot[bot] in chainguard-dev/melange#2628

Full Changelog: chainguard-dev/melange@v0.59.2...v0.59.3

Release v0.59.2

What's Changed

• build(deps): bump the gomod group across 1 directory with 5 updates by @​dependabot[bot] in chainguard-dev/melange#2618
• build(deps): bump chainguard-dev/actions/setup-gitsign from 1.6.30 to 1.6.31 in the actions group by @​dependabot[bot] in chainguard-dev/melange#2617
• Remove stale SHA-1 signature references by @​xnox in chainguard-dev/melange#2620
• build(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @​dependabot[bot] in chainguard-dev/melange#2622
• build(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 in the actions group by @​dependabot[bot] in chainguard-dev/melange#2623
• build(deps): bump the gomod group across 1 directory with 4 updates by @​dependabot[bot] in chainguard-dev/melange#2621

Full Changelog: chainguard-dev/melange@v0.59.1...v0.59.2

Release v0.59.1

What's Changed

• Fetch license-check sources with native handlers by @​EyeCantCU in chainguard-dev/melange#2619

Full Changelog: chainguard-dev/melange@v0.59.0...v0.59.1

Commits

• 93b6e11 build: keep setuid/setgid/sticky on unpacked directories (#2646)
• 7e518c0 build(deps): bump the actions group across 1 directory with 3 updates (#2640)
• c3d1a70 pre-commit: drop .git suffix from repo URL (#2644)
• 476f30c build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 (#2638)
• e2a8cf8 sca: add support for new Chainguard Go 1.27 toolchains (#2643)
• fc03246 git-checkout: disable git auto background maintenance (#2639)
• fa02ea3 build(deps): bump the gomod group across 1 directory with 3 updates (#2628)
• 1400bf0 Upgrade to go1.27 (#2627)
• 445d242 build(deps): bump the actions group with 2 updates (#2626)
• 2043d30 build(deps): bump the gomod group with 4 updates (#2621)
• Additional commits viewable in compare view