chore(deps): bump the docker-dependencies group across 2 directories with 2 updates

.coverage-baseline

@@ -1 +1 @@
-78.5
+76.7

.devcontainer/Dockerfile

@@ -2,7 +2,7 @@
 # Stage 1: CI base image with essential build tools
 # Pinned by digest (Scorecard "pinned dependencies"); Dependabot's docker
 # ecosystem keeps version + digest current together.
-FROM golang:1.26.7-bookworm@sha256:6ef6e30f0ea5c384f6d111cf856e024e3086bbdcb1779da3f3b3fbba0aea53d2 AS ci
+FROM golang:1.27.0-bookworm@sha256:484ef6066fa69acb059fdfeda7ba2b8f7391f2ef6abc6f9b8411e669ebd56466 AS ci
 
 # Avoid warnings by switching to noninteractive
 ENV DEBIAN_FRONTEND=noninteractive
@@ -65,23 +65,23 @@ RUN apt-get update \
 # VALE_VERSION -> https://github.com/vale-cli/vale/releases
 
 ENV PATH="/go/bin:/usr/local/go/bin:${PATH}" \
-    KUBECTL_VERSION=v1.36.2 \
+    KUBECTL_VERSION=v1.36.4 \
     KUSTOMIZE_VERSION=5.8.1 \
     KUBEBUILDER_VERSION=4.15.0 \
-    GOLANGCI_LINT_VERSION=v2.12.2 \
-    HELM_VERSION=v4.2.3 \
+    GOLANGCI_LINT_VERSION=v2.13.1 \
+    HELM_VERSION=v4.2.4 \
     K3D_VERSION=v5.9.0 \
-    FLUX_VERSION=2.9.2 \
-    FLUX_OPERATOR_VERSION=0.55.0 \
-    TASK_VERSION=v3.52.0 \
+    FLUX_VERSION=2.9.4 \
+    FLUX_OPERATOR_VERSION=0.58.1 \
+    TASK_VERSION=v3.53.1 \
     ACTIONLINT_VERSION=1.7.12 \
-    HADOLINT_VERSION=2.14.0 \
-    VALKEY_VERSION=9.1.0 \
-    COSIGN_VERSION=v3.1.2 \
+    HADOLINT_VERSION=2.15.1 \
+    VALKEY_VERSION=9.1.1 \
+    COSIGN_VERSION=v3.1.3 \
     ORAS_VERSION=1.3.3 \
-    NODE_MAJOR=22 \
-    MARKDOWNLINT_CLI2_VERSION=0.23.1 \
-    VALE_VERSION=3.15.1
+    NODE_MAJOR=24 \
+    MARKDOWNLINT_CLI2_VERSION=0.23.2 \
+    VALE_VERSION=3.18.0
 
 # Fail early on unsupported architectures instead of producing a partial image.
 RUN test "$(dpkg --print-architecture)" = "amd64" \
@@ -149,14 +149,17 @@ RUN asset="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
     && install -m 0755 actionlint /usr/local/bin/actionlint \
     && rm -rf "${tmpdir}"
 
-# Install hadolint (static linter for Dockerfiles)
+# Install hadolint (static linter for Dockerfiles). Since 2.15.0 the release no
+# longer ships a per-asset .sha256 file, only one combined checksums.sha256 in
+# `sha256sum *filename` format (space-asterisk, not the two-space format the
+# other combined-checksum tools below use).
 RUN asset="hadolint-linux-x86_64" \
     && base="https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}" \
     && tmpdir="$(mktemp -d)" \
     && curl -fsSL "${base}/${asset}" -o "${tmpdir}/${asset}" \
-    && curl -fsSL "${base}/${asset}.sha256" -o "${tmpdir}/${asset}.sha256" \
+    && curl -fsSL "${base}/checksums.sha256" -o "${tmpdir}/checksums.sha256" \
     && cd "${tmpdir}" \
-    && sha256sum -c "${asset}.sha256" \
+    && grep " \*${asset}$" checksums.sha256 | sha256sum -c - \
     && install -m 0755 "${asset}" /usr/local/bin/hadolint \
     && rm -rf "${tmpdir}"
 
@@ -254,10 +257,10 @@ RUN chgrp -R godev /go && \
 
 # Install Go tools used by the project (using @version doesn't need go.mod)
 # These run AFTER permissions are set to ensure proper group ownership
-RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.19.0 \
-    && go install github.com/onsi/ginkgo/v2/ginkgo@v2.28.1 \
-    && go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20260318145839-6c9615a2a166 \
-    && go install golang.org/x/tools/cmd/goimports@v0.43.0 \
+RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.21.0 \
+    && go install github.com/onsi/ginkgo/v2/ginkgo@v2.32.1 \
+    && go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.24.1 \
+    && go install golang.org/x/tools/cmd/goimports@v0.49.0 \
     && go install github.com/boyter/scc/v3@v3.7.0
 
 # Initialize golangci-lint cache by running it once on an empty directory
@@ -318,10 +321,10 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 # DLV_VERSION -> https://github.com/go-delve/delve/releases
 # GOPLS_VERSION -> https://github.com/golang/tools/releases
 # STATICCHECK_VERSION -> https://github.com/dominikh/go-tools/releases
-ENV TILT_VERSION=v0.37.4 \
-    DLV_VERSION=v1.27.0 \
+ENV TILT_VERSION=v0.37.7 \
+    DLV_VERSION=v1.27.1 \
     GOPLS_VERSION=v0.23.0 \
-    STATICCHECK_VERSION=v0.7.0
+    STATICCHECK_VERSION=v0.8.1
 
 # Kind is already installed in the ci stage above.
 RUN apt-get update \

.github/workflows/release.yml

@@ -156,7 +156,7 @@ jobs:
           # is the only other job that signs release artifacts (publish-helm),
           # and it gets cosign from that image. Without this input the action
           # defaults to its own (older) pinned cosign release.
-          cosign-release: v3.1.2
+          cosign-release: v3.1.3
 
       - name: Sign the multi-arch image (cosign keyless)
         # One signature on the digest covers every tag pointing at it.

.golangci.yml

@@ -360,15 +360,15 @@ linters:
         path: 'test/(utils|e2e)/.*\.go'
         linters: [staticcheck]
       # Kubernetes controller-runtime still uses this pattern in API packages.
-      - text: "SA1019: scheme.Builder is deprecated"
+      - text: "SA1019:.*scheme\\.Builder is deprecated"
         path: 'api/v1alpha3/groupversion_info\.go'
         linters: [staticcheck]
       # mgr.GetEventRecorderFor returns the record.EventRecorder our shared status writer emits on
       # (a single Event per persisted Ready transition). It is the ubiquitous kubebuilder idiom; the
       # non-deprecated GetEventRecorder returns the newer events.EventRecorder, whose Eventf demands
       # an action verb and a note and does not fit a one-line status Event. Newer staticcheck
       # flags the deprecation; scope the allowance to where the manager is wired.
-      - text: "SA1019: mgr.GetEventRecorderFor is deprecated"
+      - text: "SA1019:.*GetEventRecorderFor is deprecated"
         path: 'cmd/main\.go'
         linters: [staticcheck]
       # Allow fmt.Print* in test/e2e (debugging outputs)

Dockerfile

@@ -1,7 +1,7 @@
 # Build the manager binary
 # Base images are pinned by digest (Scorecard "pinned dependencies");
 # Dependabot's docker ecosystem keeps version + digest current together.
-FROM golang:1.26.7@sha256:45a5f7a810238aabcbad211d70b9ae082022d96f7c7259e94041ad1b933575ac AS builder
+FROM golang:1.27.0@sha256:65b6f280bf050ec5af12716857e8ea8439d694dbba8f31ceeb7630670071f2bb AS builder
 
 # Automatic platform arguments provided by Docker BuildKit
 ARG TARGETOS
@@ -65,7 +65,7 @@ RUN case "${TARGETARCH}" in \
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:debug@sha256:e741251ccc55dd6cec4a99ff21c0766df31891fabb4a50727104619a7e6ff4f2
+FROM gcr.io/distroless/static:debug@sha256:53cd815b916ffc1751285f307bdaa728f459224296e97af342e73e4cebeb41e8
 WORKDIR /
 COPY --from=builder /workspaces/manager .
 COPY --from=sops-downloader /usr/local/bin/sops /usr/local/bin/sops

go.mod

@@ -1,6 +1,6 @@
 module github.com/ConfigButler/gitops-reverser
 
-go 1.26.7
+go 1.27.0
 
 require (
 	filippo.io/age v1.3.1

internal/queue/author_fact.go

@@ -143,7 +143,7 @@ const (
 // carries, so a fact without it could not be joined at all for that whole population. "No code reads
 // it" and "nothing could ever read it" are different claims, and only the second justifies dropping a
 // field.
-type AuthorFact struct { //nolint:recvcheck // UnmarshalJSON must take a pointer; every other method only reads.
+type AuthorFact struct {
 	Namespace string `json:"namespace,omitempty"`
 	UID       string `json:"uid,omitempty"`
 	// Name is the object's name, and it feeds one tier only: the (namespace, name) join a fact with

test/mutationlab/Dockerfile

@@ -1,6 +1,6 @@
 # Mutation-capture lab image. Built and deployed only by `task lab-e2e`; it is
 # never part of the product image, the Helm chart, or the default CI lane.
-FROM golang:1.26.7 AS builder
+FROM golang:1.27.0 AS builder
 
 ARG TARGETOS
 ARG TARGETARCH