feat: bump dependencies

``` | Package | Update | Change | |---|---|---| | [containerd/stargz-snapshotter](https://redirect.github.com/containerd/stargz-snapshotter) | minor | `v0.15.1` -> `v0.16.2` | | [containers/crun](https://redirect.github.com/containers/crun) | minor | `1.17` -> `1.18.2` | | git://git.kernel.org/pub/scm/libs/libcap/libcap.git | minor | `2.70` -> `2.72` | | git://sourceware.org/git/elfutils.git | minor | `0.191` -> `0.192` | | [google/gvisor](https://redirect.github.com/google/gvisor) | minor | `20241007.0` -> `20241118.0` | | [https://github.com/qemu/qemu.git](https://redirect.github.com/qemu/qemu) | patch | `9.1.0` -> `9.1.2` | | [https://github.com/spinkube/containerd-shim-spin.git](https://redirect.github.com/spinkube/containerd-shim-spin) | minor | `v0.16.0` -> `v0.17.0` | | [tailscale/tailscale](https://redirect.github.com/tailscale/tailscale) | patch | `1.76.0` -> `1.76.6` | ``` Signed-off-by: Andrey Smirnov <[email protected]>
siderolabs · Nov 28, 2024 · c5fa260 · c5fa260
1 parent daa889b
commit c5fa260
Show file tree

Hide file tree

Showing 26 changed files with 126 additions and 56 deletions.
diff --git a/.kres.yaml b/.kres.yaml
@@ -63,7 +63,7 @@ spec:
       - name: EXTENSIONS_IMAGE_REF
         defaultValue: $(REGISTRY_AND_USERNAME)/extensions:$(TAG)
       - name: PKGS
-        defaultValue: v1.9.0-alpha.0-46-g653d423
+        defaultValue: v1.9.0-alpha.0-51-g0272ad4
       - name: PKGS_PREFIX
         defaultValue: ghcr.io/siderolabs
   useBldrPkgTagResolver: true

diff --git a/Makefile b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-11-27T11:10:30Z by kres 232fe63.
+# Generated on 2024-11-28T12:29:02Z by kres 232fe63.
 
 # common variables
 
@@ -50,7 +50,7 @@ COMMON_ARGS += --build-arg=PKGS_PREFIX="$(PKGS_PREFIX)"
 # extra variables
 
 EXTENSIONS_IMAGE_REF ?= $(REGISTRY_AND_USERNAME)/extensions:$(TAG)
-PKGS ?= v1.9.0-alpha.0-46-g653d423
+PKGS ?= v1.9.0-alpha.0-51-g0272ad4
 PKGS_PREFIX ?= ghcr.io/siderolabs
 
 # targets defines all the available targets

diff --git a/container-runtime/crun/pkg.yaml b/container-runtime/crun/pkg.yaml
@@ -8,13 +8,13 @@ steps:
       # {{ if eq .ARCH "aarch64" }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/containers/crun/releases/download/{{ .CRUN_VERSION }}/crun-{{ .CRUN_VERSION }}-linux-arm64-disable-systemd
         destination: crun
-        sha256: 44b06c0ab2cc79e4bc1274e5f51cb3dbdf450c4317795f37e8a0c48a3f1924c0
-        sha512: 7a4fb10c7576fd1d4fae11331554d2d79e0d72be7a4466ef89046cc4eb364af44158fbae87287a12b4e675e11f708a5dd4eca46d3bf32b4d4dcaf8227f1cc962
+        sha256: 108a25b7ffebb31c8d7c63c95fdd3b850a256b8af872bab54a517440062586f1
+        sha512: cdaf6786c1328c247404998b5fca783f94ce67b402faf305a6572478283835bfec45d16bfa7658cd2bf2f0455b3a94199a00debf671b1100a483f33ceb84501d
       # {{ else }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/containers/crun/releases/download/{{ .CRUN_VERSION }}/crun-{{ .CRUN_VERSION }}-linux-amd64-disable-systemd
         destination: crun
-        sha256: 549e0b55ac278cb4d50bfc03c75da8d7f05f6232a35b15a488e8b4bef7ba6e38
-        sha512: fa0538c1acd2a1297f170db752fe7872480bd89fdd1a0c20f7ba9b389fc2f639836f71fb14de0d718e9a2651fbf7f3f0c6764b95956765e057ca69609c217848
+        sha256: c608902ecbaaae608348c9a95b9eea8335a1c16aae89ce6ab1de1c15db4267d2
+        sha512: 97661c3279ccc12473a05d01931e73268af3cc9aedca1b920c797574bad5776144142193e5219023fbdc19d0e67100a3f54e5a81f3df15a612f3b44ab1df3844
     # {{ end }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
     prepare:
       - |

diff --git a/container-runtime/gvisor/pkg.yaml b/container-runtime/gvisor/pkg.yaml
@@ -7,10 +7,10 @@ steps:
   - sources:
       # gvisor repo 'master' branch is Bazel-bazed, so we need to find matching commit in the "go" branch
       # find the go-branch specific merge commit ("Merge release-... (automated)") which has the release-tagged commit as a parent
-      - url: https://github.com/google/gvisor/archive/e8e35a6608f56c5b2c118b54bc92a93b74cb169f.tar.gz
+      - url: https://github.com/google/gvisor/archive/2f1ef2228e0ca861ced3ecc562f2629d6b2aa45a.tar.gz
         destination: gvisor.tar.gz
-        sha256: 68e5877020f4b394f042d905ee761bbb596b6e8d4b5d7b71a262a6f9b74b6a43
-        sha512: ca4b698d28a35299971f6790fcaeef31f10e8560ec0c4fddfbe744596253e28911f8c25d93e6f0b9eecbd74a611c19023a214bf979f680d6089695235417caa1
+        sha256: 63419d6c5744f17f8f8229919ed2399e5e8d567735379b22f34acba2cfc8ab34
+        sha512: 567f72bbf701176e394ca5ad6ba1be8432e56d8f48344dc9561dba668536ca3132c7f9b8a19485b9518d35783b32426318def14e7ca9cc7c682ab26f1db9e293
     env:
       GOPATH: /go
     cachePaths:

diff --git a/container-runtime/spin/pkg.yaml b/container-runtime/spin/pkg.yaml
@@ -8,13 +8,13 @@ steps:
     # {{ if eq .ARCH "aarch64" }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/spinkube/containerd-shim-spin/releases/download/{{ .SPIN_VERSION }}/containerd-shim-spin-v2-linux-aarch64.tar.gz
         destination: containerd-shim-spin.tar.gz
-        sha256: a9f633e795091fe43701dacfa08faa00912083e79544644966c4d46b9b4dd2fa
-        sha512: 84f901f0410158363ae3ae74dccabcb5f31eb03491206a1cbf486d203e63445a9b0f31cb3dd2b342d4694bfe764c7e92aaad2884d32bed14af95218c0549fb59
+        sha256: 51f740cfb93e71311685b7f4e9086df06ec6a821c6dbeab2306af268c4a6e233
+        sha512: fbaa3179e54ea60d0d385cf107af4a831ee18819089e4b70fa2366d890dd3e060015e159ba778d523569732fe3b4d5149dbd5a6ae1a64ad137efdfffcb0e7d82
     # {{ else }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/spinkube/containerd-shim-spin/releases/download/{{ .SPIN_VERSION }}/containerd-shim-spin-v2-linux-x86_64.tar.gz
         destination: containerd-shim-spin.tar.gz
-        sha256: 4f9ff48e805a66a86b45a6c72c0052c1b877dbd442764302a22a9608c2e60bd1
-        sha512: 2bfcbb1b9a1ea1039f9d19274170f64809ab2f851a4f044f000ba552dcb659fd54310ce075e1d02c30eee82c81121c0d4d4c8a3c91db119bde78adfa5f52469b
+        sha256: 4920d4f3db3c6709344272820e1782700d87791511721ef5dfcb70352391d40d
+        sha512: 018f0ffcf80fcfd6c9fe8b6035211c164dbabc66645a1f5f523793b693a630df0beeb87de5209564510b8d10921d2190e6cb8b29595f041f426edf7bcd4ff742
     # {{ end }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
     prepare:
       - |

diff --git a/container-runtime/stargz-snapshotter/pkg.yaml b/container-runtime/stargz-snapshotter/pkg.yaml
@@ -7,8 +7,8 @@ steps:
   - sources:
       - url: https://github.com/containerd/stargz-snapshotter/archive/refs/tags/{{ .STARGZ_SNAPSHOTTER_VERSION }}.tar.gz
         destination: stargz-snapshotter.tar.gz
-        sha256: ca4a2052248507d9504468d6d2f6b3c4ab1daf1b5e83f27431309c02879ddb34
-        sha512: 3cc86e690ed63ed48acc3205225400e8fc6f64147e3f7424864e09007feb6ca8168fcc17bf60290519172cc049d6ccf338d4b223ac4e5050f35dee287318ade4
+        sha256: 9b41555baf7d4f9cfc2d83caff2cdc2ab4331ee288acdc6ec1e3d40c850b970b
+        sha512: 5a5f8cecda31d4530f41e74b7e30f99215b3bd33f47d515c381529a619dfd74b1af521b49e41216aca9169135a0cb3050adc7c6c0d613f6488b0bd346d3e75cf
     env:
       GOPATH: /go
     cachePaths:

diff --git a/container-runtime/vars.yaml b/container-runtime/vars.yaml
@@ -1,14 +1,14 @@
 # renovate: datasource=github-tags extractVersion=^release-(?<version>.*)$ depName=google/gvisor
-GVISOR_VERSION: 20241007.0
+GVISOR_VERSION: 20241118.0
 # renovate: datasource=github-releases depName=containerd/stargz-snapshotter
-STARGZ_SNAPSHOTTER_VERSION: v0.15.1
+STARGZ_SNAPSHOTTER_VERSION: v0.16.2
 # renovate: datasource=github-releases depName=kubernetes/cloud-provider-aws
 CLOUD_PROVIDER_AWS_VERSION: v1.31.1
 # renovate: datasource=git-tags extractVersion=^containerd-shim-wasmedge\/(?<version>.*)$ depName=https://github.com/containerd/runwasi.git
 WASMEDGE_VERSION: v0.4.0
 # renovate: datasource=git-tags depName=https://github.com/spinkube/containerd-shim-spin.git
-SPIN_VERSION: v0.16.0
+SPIN_VERSION: v0.17.0
 # renovate: datasource=github-releases depName=kata-containers/kata-containers
 KATA_CONTAINERS_VERSION: 3.3.0
 # renovate: datasource=github-releases depName=containers/crun
-CRUN_VERSION: 1.17
+CRUN_VERSION: 1.18.2
diff --git a/go.work b/go.work
@@ -1,4 +1,4 @@
-go 1.22
+go 1.23.0
 
 use (
 	./examples/hello-world-service/src

diff --git a/guest-agents/qemu-guest-agent/pkg.yaml b/guest-agents/qemu-guest-agent/pkg.yaml
@@ -10,8 +10,8 @@ steps:
   - sources:
       - url: https://download.qemu.org/qemu-{{ .QEMU_VERSION }}.tar.xz
         destination: qemu.tar.xz
-        sha256: 816b7022a8ba7c2ac30e2e0cf973e826f6bcc8505339603212c5ede8e94d7834
-        sha512: bf61d65e37945fa8ee8640712c719ace05164d86e6df700b98bdc5f79e0a8d5e8f85bd48e726edb62b2419db20673f63ec8b63a60393a914b09cb365621b35e2
+        sha256: 19fd9d7535a54d6e044e186402aa3b3b1bdfa87c392ec8884855592c8510c96f
+        sha512: ff6ed9bc784f1aa7cf06604d0e38e26ebb2685885893a2cb7d044297f26d7efd0fa6cbb034dc1c422b58504ca1081b46ffe00dd8f9fab928cafa8cfc0d7d1747
     prepare:
       - |
         sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml

diff --git a/guest-agents/vars.yaml b/guest-agents/vars.yaml
@@ -1,5 +1,5 @@
 # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=https://github.com/qemu/qemu.git
-QEMU_VERSION: 9.1.0
+QEMU_VERSION: 9.1.2
 # renovate: datasource=git-tags depName=https://gitlab.gnome.org/GNOME/glib.git
 GLIB_VERSION: 2.82.0
 # renovate: datasource=github-releases extractVersion=^pcre2-(?<version>.*)$ depName=PCRE2Project/pcre2

diff --git a/hack/release.toml b/hack/release.toml
@@ -33,11 +33,12 @@ Upgrades via Image Factory will automatically include the new extensions if prev
         title = "Component Updates"
         description = """\
 Linux Firmware: 20241110
-Tailscale: 1.76.0
-crun: 1.17
-gvisor: 20241007.0
-spin: 0.16.0
+Tailscale: 1.76.6
+crun: 1.18.2
+gvisor: 20241118.0
+spin: 0.17.0
 ecr-credential-provider: 1.31.1
+stargz-snapshotter: 0.16.2
 Intel microcode: 20241112
 NVIDIA LTS: 535.216.03
 NVIDIA Production: 550.127.08

diff --git a/misc/glibc/vars.yaml b/misc/glibc/vars.yaml
@@ -1,4 +1,4 @@
 # renovate: datasource=docker versioning=docker depName=cgr.dev/chainguard/wolfi-base
-WOLFI_BASE_REF: sha256:0c1bf69476e3ca3d4763ca3067773e8796a1faecd56678a3b748cd90cfb9b9a5
+WOLFI_BASE_REF: sha256:8dd9ceace8b1574e550374e9c07c2baafa60cc96223c1314fac61bd2edb48c70
 
 VERSION: {{ .GLIBC_VERSION }}
diff --git a/network/tailscale/pkg.yaml b/network/tailscale/pkg.yaml
@@ -12,8 +12,8 @@ steps:
     sources:
       - url: https://github.com/tailscale/tailscale/archive/refs/tags/v{{ .TAILSCALE_VERSION }}.tar.gz
         destination: tailscale.tar.gz
-        sha256: eaec1fa9a882d877ce6e5fb6ef47b3387124321a8963c66c4c37319106b5c5c2
-        sha512: cfae501c42f67ca1c51b11ee6ac3c1715e224daf38ec35d2ad4be34da1f1f6aa62cd187dd4741214e4cabf6f356e05b32826033d21c15e4acbadbbbfd23dcdcf
+        sha256: 1603c78a6a5e9f83b278d305e1196fbfdeeb841be10ac2ddb7ea433c2701234b
+        sha512: 00173b25685c6800fb5b914e9cb1dbfd55b9ddada2006c310d388af4c12760830281717c374113d525103ed77508d2bf8ac260c596ea5c4068c0ca6a35d58c96
     prepare:
       - |
         sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml

diff --git a/network/vars.yaml b/network/vars.yaml
@@ -1,4 +1,4 @@
 # renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=tailscale/tailscale
-TAILSCALE_VERSION: 1.76.0
+TAILSCALE_VERSION: 1.76.6
 # renovate: datasource=github-releases depName=lldpd/lldpd
 LLDPD_VERSION: 1.0.18
diff --git a/nvidia-gpu/nvidia-container-toolkit/nvidia-container-cli/elfutils/pkg.yaml b/nvidia-gpu/nvidia-container-toolkit/nvidia-container-cli/elfutils/pkg.yaml
@@ -11,10 +11,10 @@ dependencies:
     from: /rootfs
 steps:
   - sources:
-      - url: https://src.fedoraproject.org/lookaside/extras/elfutils/elfutils-{{ .ELFUTILS_VERSION }}.tar.bz2/sha512/e22d85f25317a79b36d370347e50284c9120c86f9830f08791b7b6a7b4ad89b9bf4c7c71129133b8d193a0edffb2a2c17987b7e48428b9670aff5ce918777e04/elfutils-{{ .ELFUTILS_VERSION }}.tar.bz2
+      - url: https://src.fedoraproject.org/lookaside/extras/elfutils/elfutils-{{ .ELFUTILS_VERSION }}.tar.bz2/sha512/543188f5f2cfe5bc7955a878416c5f252edff9926754e5de0c6c57b132f21d9285c9b29e41281e93baad11d4ae7efbbf93580c114579c182103565fe99bd3909/elfutils-{{ .ELFUTILS_VERSION }}.tar.bz2
         destination: elfutils.tar.bz2
-        sha256: df76db71366d1d708365fc7a6c60ca48398f14367eb2b8954efc8897147ad871
-        sha512: e22d85f25317a79b36d370347e50284c9120c86f9830f08791b7b6a7b4ad89b9bf4c7c71129133b8d193a0edffb2a2c17987b7e48428b9670aff5ce918777e04
+        sha256: 616099beae24aba11f9b63d86ca6cc8d566d968b802391334c91df54eab416b4
+        sha512: 543188f5f2cfe5bc7955a878416c5f252edff9926754e5de0c6c57b132f21d9285c9b29e41281e93baad11d4ae7efbbf93580c114579c182103565fe99bd3909
     prepare:
       - |
         tar -xjf elfutils.tar.bz2 --strip-components=1

diff --git a/nvidia-gpu/nvidia-container-toolkit/nvidia-container-cli/libcap2/patches/getdents.patch b/nvidia-gpu/nvidia-container-toolkit/nvidia-container-cli/libcap2/patches/getdents.patch
@@ -0,0 +1,66 @@
+From 304089b078f2f339cd7ccb030a0ad0194aea0a0f Mon Sep 17 00:00:00 2001
+From: Xi Ruoyao <[email protected]>
+Date: Tue, 12 Nov 2024 11:44:56 +0800
+Subject: psx: use getdents64 instead of getdents
+
+On relatively new architectures (for example ARM64, RISC-V, and
+LoongArch), the kernel does not have a getdents syscall.  Use getdents64
+instead to fix the build on them.
+
+The getdents64 syscall was added in Linux 2.4 and I don't think we
+should still support older kernels today.
+
+Signed-off-by: Xi Ruoyao <[email protected]>
+Signed-off-by: Andrew G. Morgan <[email protected]>
+---
+ psx/psx.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/psx/psx.c b/psx/psx.c
+index d66a7bf..bf7d69f 100644
+--- a/psx/psx.c
++++ b/psx/psx.c
+@@ -410,10 +410,11 @@ static long int __psx_immediate_syscall(long int syscall_nr,
+
+ #define BUF_SIZE 4096
+
+-struct psx_linux_dirent {
+-    unsigned long d_ino;
+-    off_t d_off;
++struct psx_linux_dirent64 {
++    long long d_ino;
++    long long d_off;
+     unsigned short d_reclen;
++    unsigned char d_type;
+     char d_name[];
+ };
+
+@@ -486,11 +487,11 @@ long int __psx_syscall(long int syscall_nr, ...) {
+
+ 	for (;;) {
+ 	    char buf[BUF_SIZE];
+-	    size_t nread = syscall(SYS_getdents, fd, buf, BUF_SIZE);
++	    size_t nread = syscall(SYS_getdents64, fd, buf, BUF_SIZE);
+ 	    if (nread == 0) {
+ 		break;
+ 	    } else if (nread < 0) {
+-		perror("getdents failed");
++		perror("getdents64 failed");
+ 		kill(psx_tracker.pid, SIGKILL);
+ 	    }
+
+@@ -499,10 +500,10 @@ long int __psx_syscall(long int syscall_nr, ...) {
+ 	    for (offset = 0; offset < nread; offset += reclen) {
+ 		/* deal with potential unaligned reads */
+ 		memcpy(&reclen, buf + offset +
+-		       offsetof(struct psx_linux_dirent, d_reclen),
++		       offsetof(struct psx_linux_dirent64, d_reclen),
+ 		       sizeof(reclen));
+ 		char *dir = (buf + offset +
+-			     offsetof(struct psx_linux_dirent, d_name));
++			     offsetof(struct psx_linux_dirent64, d_name));
+ 		long tid = atoi(dir);
+ 		if (tid == 0 || tid == self) {
+ 		    continue;
+--
+cgit 1.2.3-korg
diff --git a/nvidia-gpu/nvidia-container-toolkit/nvidia-container-cli/libcap2/pkg.yaml b/nvidia-gpu/nvidia-container-toolkit/nvidia-container-cli/libcap2/pkg.yaml
@@ -4,17 +4,20 @@ shell: /bin/bash
 install:
   - build-base
   - bash
+  - patch
 dependencies:
   - image: cgr.dev/chainguard/wolfi-base@{{ .WOLFI_BASE_REF }}
 steps:
   - sources:
       - url: https://kernel.org/pub/linux/libs/security/linux-privs/libcap2/libcap-{{ .LIBCAP_VERSION }}.tar.xz
         destination: libcap.tar.xz
-        sha256: 23a6ef8aadaf1e3e875f633bb2d116cfef8952dba7bc7c569b13458e1952b30f
-        sha512: 4e0bf0efeccb654c409afe9727b2b53c1d4da8190d7a0a9848fc52550ff3e13502add3eacde04a68a5b7bec09e91df487f64c5746ba987f873236a9e53b3d4e8
+        sha256: 0274f5a15a5205f656d8f0169eef711dd29158ba8ad3b240618b342b2460175b
+        sha512: c0726bcd5e48395c6f4edd34f0fcaa21d7b2fe35dbc88824c0d86b42859dbe507f55c1ac7f7352e2aa56e3632b7aa9a098ca9cc730c82f942106d2786b10ba2c
     prepare:
       - |
         tar -xf libcap.tar.xz --strip-components=1
+      - |
+        patch -p1 < /pkg/patches/getdents.patch
     build:
       - |
         make prefix=/usr/local/glibc lib=lib -j $(nproc)

diff --git a/nvidia-gpu/nvidia-container-toolkit/nvidia-container-runtime-wrapper/go.mod b/nvidia-gpu/nvidia-container-toolkit/nvidia-container-runtime-wrapper/go.mod
@@ -1,5 +1,5 @@
 module nvidia-container-runtime-wrapper
 
-go 1.22
+go 1.23.0
 
-require golang.org/x/sys v0.24.0
+require golang.org/x/sys v0.27.0
diff --git a/nvidia-gpu/nvidia-container-toolkit/nvidia-container-runtime-wrapper/go.sum b/nvidia-gpu/nvidia-container-toolkit/nvidia-container-runtime-wrapper/go.sum
@@ -1,2 +1,2 @@
-golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
-golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
diff --git a/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.mod b/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.mod
@@ -1,5 +1,5 @@
 module nvidia-persistenced-wrapper
 
-go 1.22
+go 1.23.0
 
-require golang.org/x/sys v0.24.0
+require golang.org/x/sys v0.27.0
diff --git a/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.sum b/nvidia-gpu/nvidia-container-toolkit/nvidia-persistenced-wrapper/go.sum
@@ -1,2 +1,2 @@
-golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
-golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
diff --git a/nvidia-gpu/vars.yaml b/nvidia-gpu/vars.yaml
@@ -10,10 +10,10 @@ CONTAINER_TOOLKIT_REF: a470818ba7d9166be282cd0039dd2fc9b0a34d73
 LIBNVIDIA_CONTAINER_VERSION: v1.16.1
 LIBNVIDIA_CONTAINER_REF: 4c2494f16573b585788a42e9c7bee76ecd48c73d
 # renovate: datasource=docker versioning=docker depName=cgr.dev/chainguard/wolfi-base
-WOLFI_BASE_REF: sha256:0c1bf69476e3ca3d4763ca3067773e8796a1faecd56678a3b748cd90cfb9b9a5
+WOLFI_BASE_REF: sha256:8dd9ceace8b1574e550374e9c07c2baafa60cc96223c1314fac61bd2edb48c70
 # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=seccomp/libseccomp
 LIBSECCOMP_VERSION: 2.5.5
 # renovate: datasource=git-tags extractVersion=^libcap-(?<version>.*)$ depName=git://git.kernel.org/pub/scm/libs/libcap/libcap.git
-LIBCAP_VERSION: 2.70
+LIBCAP_VERSION: 2.72
 # renovate: datasource=git-tags extractVersion=^elfutils-(?<version>.*)$ depName=git://sourceware.org/git/elfutils.git
-ELFUTILS_VERSION: 0.191
+ELFUTILS_VERSION: 0.192
diff --git a/storage/iscsi-tools/iscsid-wrapper/go.mod b/storage/iscsi-tools/iscsid-wrapper/go.mod
@@ -1,5 +1,5 @@
 module iscsid-wrapper
 
-go 1.22
+go 1.23.0
 
-require golang.org/x/sys v0.24.0
+require golang.org/x/sys v0.27.0
diff --git a/storage/iscsi-tools/iscsid-wrapper/go.sum b/storage/iscsi-tools/iscsid-wrapper/go.sum
@@ -1,2 +1,2 @@
-golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
-golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
diff --git a/storage/zfs/zfs-service/go.mod b/storage/zfs/zfs-service/go.mod
@@ -1,5 +1,5 @@
 module zfs-service
 
-go 1.22
+go 1.23.0
 
-require golang.org/x/sys v0.24.0
+require golang.org/x/sys v0.27.0
diff --git a/storage/zfs/zfs-service/go.sum b/storage/zfs/zfs-service/go.sum
@@ -1,2 +1,2 @@
-golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
-golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=