chore(deps): update devbox packages

[vtmocanu]

This PR contains the following updates:

Package	Update	Change
eslint	minor	10.5.0 → 10.6.0
grype	minor	0.114.0 → 0.115.0
kubernetes-helm	patch	4.2.1 → 4.2.2
nodejs_22	patch	22.23.0 → 22.23.1

---

Release Notes

anchore/grype (grype)

v0.115.0

Added Features

• emit golang.org/x/net vulns from govlundb [PR #​3534 @​willmurphyscode]
• Merge Go vuln matches with GHSA matches [Issue #​3515]

Bug Fixes

• only emit records for stdlib [PR #​3527 @​willmurphyscode]
• mark hummingbird distro as rolling [PR #​3521 @​willmurphyscode]
• disable go stdlib CPE matching by default [PR #​3517 @​willmurphyscode]
• merge in custom ranges when applicable [PR #​3514 @​willmurphyscode]
• exclude linux-kbuild deb indirect matches by default [PR #​3506 @​westonsteimel]
• avoid panic on invalid RHEL version IDs [PR #​3490 @​jspilman]
• Support reading CycloneDX 1.7 SBOMs [Issue #​3373]
• Grype cannot read mariadb version correctly [Issue #​3452]
• grype hangs when downloading certain images using registry client [Issue #​3492]
• Can we get a fix for these Critical findings reported for grype [Issue #​3484]

Additional Changes

• Security: bump golang.org/x/crypto to v0.52.0 to resolve multiple CVEs [Issue #​3493]
• Security: bump golang.org/x/net to v0.55.0 to resolve CVEs [Issue #​3494]

Dependencies

35 dependency changes (31 updated, 3 added, 1 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

• GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
• GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
• GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
• GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
• GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2

Updated (31 packages)

• github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
• github.com/anchore/bubbly v0.2.0 → v0.2.1
• github.com/anchore/clio v0.1.0 → v0.1.1
• github.com/anchore/fangs v0.1.0 → v0.1.1
• github.com/anchore/go-collections v0.1.0 → v0.1.1
• github.com/anchore/go-homedir v0.1.0 → v0.1.1
• github.com/anchore/go-logger v0.1.0 → v0.1.1
• github.com/anchore/go-lzo v0.1.0 → v0.1.1
• github.com/anchore/go-macholibre v0.1.0 → v0.1.1
• github.com/anchore/go-make v0.5.0 → v0.8.0
• github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
• github.com/anchore/go-sync v0.1.0 → v0.1.1
• github.com/anchore/stereoscope v0.2.1 → v0.2.2
• github.com/anchore/syft v1.45.1 → v1.46.0
• github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
• github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
• github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
• github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
• github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
• github.com/google/go-containerregistry v0.21.6 → v0.21.7
• github.com/mattn/go-runewidth v0.0.19 → v0.0.21
• github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
• github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
• golang.org/x/crypto v0.52.0 → v0.53.0
• golang.org/x/mod v0.36.0 → v0.37.0
• golang.org/x/net v0.55.0 → v0.56.0
• golang.org/x/sync v0.20.0 → v0.21.0
• golang.org/x/sys v0.45.0 → v0.46.0
• golang.org/x/term v0.43.0 → v0.44.0
• golang.org/x/text v0.37.0 → v0.38.0
• golang.org/x/tools v0.45.0 → v0.46.0

Added (3 packages)

• github.com/piprate/json-gold v0.7.0
• github.com/pquerna/cachecontrol v0.0.0-1555304
• github.com/tailscale/hujson v0.0.0-ecc657c

Removed (1 package)

• github.com/google/osv-scanner v1.9.2

(Full Changelog)

helm/helm (kubernetes-helm)

v4.2.2: Helm v4.2.2

Helm v4.2.2 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

• Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #​32214

Installation and Upgrading

Download Helm v4.2.2. The common platform binaries are here:

• MacOS amd64 (checksum / 10c1e36ee8c5f2e2ee25a16599cb03ab74c0953cd889cacb980a49ba4b6574ba)
• MacOS arm64 (checksum / 5410a0dae3d5d91f45653b161260d9301aabc4ae80ae50a6605d66884b6df8ea)
• Linux amd64 (checksum / 9adafecab4d406853bba163a70e9f104f47dbbf65ce24b7653bae7e36150bcb6)
• Linux arm (checksum / 7e9490169874695e04ab1af47c5620621fc13c84219a258fcc1afdcd40ca7438)
• Linux arm64 (checksum / 78803142087a0069fa4b50d3f32a84d3ef25c14d1ee8a40fbccf86a6216d2f36)
• Linux i386 (checksum / 8e1fdcda4a476ffc5d1179c7f16d33a3d54267efa08fd720f7678277d68bc2d5)
• Linux loong64 (checksum / b8bfe96b8b0b0e2af51af4a00ef521cc5a7e03793aea3568cf8500a63ae05041)
• Linux ppc64le (checksum / 814a80fd98eb9e4c5a9d610f3b9c15ffe120c2f5e39df16a2f491723ebc90126)
• Linux s390x (checksum / d84cdf1123f20cfbef19a2af1cd6afe8b00626bd9846bccb9dae978c810c8274)
• Linux riscv64 (checksum / f07c105180dff2619ab45134b9b47b7845387e8f3299e12ebe0efb87c7548717)
• Windows amd64 (checksum / 5fad8562e98c34fa5af3ef904086a5874a6701050f9bf36e30238c975df94dcd)
• Windows arm64 (checksum / 2e993d6a1dd8197a33e65d8e90b26df9d248ff3501701dea401856aa265a2dab)

This release was signed by @​gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.2.3 and 3.21.2 are the next patch releases scheduled for July 8, 2026
• 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

• Revert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" b05881c (George Jenkins)

Full Changelog: helm/helm@v4.2.1...v4.2.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.