[red-hat-konflux]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 0fd42b29-cc3d-4945-804e-79e8663525f8

Commits

Reviewing files that changed from the base of the PR and between 081afc8 and c4d4994.

Files selected for processing: 2

• deploy/konflux/cli/rpms.lock.yaml
• deploy/konflux/e2e-odh/rpms.lock.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 7 remain after this review.

Walkthrough

Both the CLI and e2e-odh RPM lock files update the x86_64 libcurl entry from release 7.76.1-40.el9_8.8 to 7.76.1-40.el9_8.9. The entries include updated RPM metadata.

Estimated code review effort: 1 (Trivial) | ~4 minutes

Merge Risk: Minimal · previous review c4d49

No actionable merge-blocking risk was identified in these dependency lockfile updates.

Pre-merge checks: 10

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies a dependency lockfile refresh and accurately reflects the libcurl RPM updates.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Contribution Quality And Spam Detection		PASS. The PR changes only two RPM lockfiles and updates libcurl from 7.76.1-40.el9_8.8 to 7.76.1-40.el9_8.9, including matching URLs, checksums, EVR values, and source RPMs for x86_64. The description…
No Hardcoded Secrets		PASS. The PR changes only public Red Hat RPM URLs, package sizes, SHA-256 hex checksums, and libcurl version metadata in two lockfiles. No API keys, tokens, passwords, private keys, credential URLs, o…
No Weak Cryptography		PASS. The PR changes only two RPM lock entries for libcurl. The added integrity fields use SHA-256, not banned SHA-1. The diff adds no MD5, DES, 3DES, RC4, Blowfish, ECB, custom cryptography, or secre…
No Injection Vectors		No injection vector is introduced. The PR changes only RPM lock metadata for libcurl in two YAML files: URL, size, checksum, EVR, and source RPM. No SQL construction, shell execution, dynamic evalua…
No Privileged Containers		PASS: The pull request changes only two RPM lockfiles. The diff updates libcurl package metadata from 7.76.1-40.el9_8.8 to 7.76.1-40.el9_8.9. It adds no Kubernetes/OpenShift manifest, Helm template, o…
No Sensitive Data In Logs		PASS. The PR changes only two RPM lockfiles. The diff updates the public libcurl RPM URL, size, checksum, EVR, and source RPM from 7.76.1-40.el9_8.8 to 7.76.1-40.el9_8.9. It adds no logging statements…

Full details: Contribution Quality And Spam Detection

Explanation

PASS. The PR changes only two RPM lockfiles and updates libcurl from 7.76.1-40.el9_8.8 to 7.76.1-40.el9_8.9, including matching URLs, checksums, EVR values, and source RPMs for x86_64. The description cites CVE-2026-8932 and gives a concrete mTLS connection-reuse threat model with advisory links. This is a real dependency security update, so the security-theater caveat applies. No code-quality signal is present, and cross-repository evidence is unavailable. The required two signals from different categories are not established.

Full details: No Hardcoded Secrets

Explanation

PASS. The PR changes only public Red Hat RPM URLs, package sizes, SHA-256 hex checksums, and libcurl version metadata in two lockfiles. No API keys, tokens, passwords, private keys, credential URLs, or secret-named string assignments are present. The 64-character values are checksums, not base64 secrets. No CWE or CVE finding applies to this check.

Full details: No Weak Cryptography

Explanation

PASS. The PR changes only two RPM lock entries for libcurl. The added integrity fields use SHA-256, not banned SHA-1. The diff adds no MD5, DES, 3DES, RC4, Blowfish, ECB, custom cryptography, or secret comparisons. CVE-2026-8932 concerns mTLS connection reuse and does not introduce a banned primitive.

Full details: No Injection Vectors

Explanation

No injection vector is introduced. The PR changes only RPM lock metadata for libcurl in two YAML files: URL, size, checksum, EVR, and source RPM. No SQL construction, shell execution, dynamic evaluation, unsafe deserialization, or HTML injection pattern is present. CWE-78, CWE-79, CWE-89, CWE-94, and CWE-502 do not apply.

Full details: No Privileged Containers

Explanation

PASS: The pull request changes only two RPM lockfiles. The diff updates libcurl package metadata from 7.76.1-40.el9_8.8 to 7.76.1-40.el9_8.9. It adds no Kubernetes/OpenShift manifest, Helm template, or Dockerfile changes, and no privileged-container settings such as privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root user settings.

Full details: No Sensitive Data In Logs

Explanation

PASS. The PR changes only two RPM lockfiles. The diff updates the public libcurl RPM URL, size, checksum, EVR, and source RPM from 7.76.1-40.el9_8.8 to 7.76.1-40.el9_8.9. It adds no logging statements, request or response logging, credentials, tokens, or PII. The referenced CVE-2026-8932 is unrelated to sensitive data in logs.