Bump Helm Chart and Dagger Version => v1.82.0

[github-actions]

A new Chainloop release is available! Bumping Helm Chart reference and Dagger version to v1.82.0

[cubic-dev-ai]

3 issues found across 16 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="deployment/chainloop/Chart.yaml">

<violation number="1" location="deployment/chainloop/Chart.yaml:10">
P2: Use a patch bump for the Helm chart version instead of incrementing the minor version.</violation>
</file>

<file name="deployment/chainloop/values.yaml">

<violation number="1" location="deployment/chainloop/values.yaml:141">
P2: Bump `deployment/chainloop/Chart.yaml`'s patch version alongside this values change, or Helm consumers can miss the updated package because the chart version stays `1.343.0`.</violation>
</file>

<file name="vuln-control-plane-migrations-amd64.json">

<violation number="1" location="vuln-control-plane-migrations-amd64.json:23">
P0: The new `control-plane-migrations:v1.82.0-amd64` artifact is built with vulnerable Go stdlib `go1.25.7`, and the scan already reports two high-severity CVEs with fixes available in `1.25.8`/`1.26.1`. Releasing this image would ship known vulnerabilities.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P0: The new control-plane-migrations:v1.82.0-amd64 artifact is built with vulnerable Go stdlib go1.25.7, and the scan already reports two high-severity CVEs with fixes available in 1.25.8/1.26.1. Releasing this image would ship known vulnerabilities.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At vuln-control-plane-migrations-amd64.json, line 23:

<comment>The new `control-plane-migrations:v1.82.0-amd64` artifact is built with vulnerable Go stdlib `go1.25.7`, and the scan already reports two high-severity CVEs with fixes available in `1.25.8`/`1.26.1`. Releasing this image would ship known vulnerabilities.</comment>

<file context>
@@ -0,0 +1,227 @@
+              },
+              "helpUri": "https://github.com/anchore/grype",
+              "help": {
+                "text": "Vulnerability CVE-2026-25679\nSeverity: high\nPackage: stdlib\nVersion: go1.25.7\nFix Version: 1.25.8,1.26.1\nType: go-module\nLocation: /atlas\nData Namespace: nvd:cpe\nLink: [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679)",
+                "markdown": "**Vulnerability CVE-2026-25679**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | stdlib  | go1.25.7  | 1.25.8,1.26.1  | go-module  | /atlas  | nvd:cpe  | [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679)  |\n"
+              },
</file context>

[cubic-dev-ai]

P2: Use a patch bump for the Helm chart version instead of incrementing the minor version.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At deployment/chainloop/Chart.yaml, line 10:

<comment>Use a patch bump for the Helm chart version instead of incrementing the minor version.</comment>

<file context>
@@ -7,9 +7,9 @@ description: Chainloop is an open source software supply chain control plane, a
 type: application
 # Bump the patch (not minor, not major) version on each change in the Chart Source code
-version: 1.342.1
+version: 1.343.0
 # Do not update appVersion, this is handled automatically by the release process
-appVersion: v1.81.2
</file context>

Suggested change

	version: 1.343.0
	version: 1.342.2

[cubic-dev-ai]

P2: Bump deployment/chainloop/Chart.yaml's patch version alongside this values change, or Helm consumers can miss the updated package because the chart version stays 1.343.0.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At deployment/chainloop/values.yaml, line 141:

<comment>Bump `deployment/chainloop/Chart.yaml`'s patch version alongside this values change, or Helm consumers can miss the updated package because the chart version stays `1.343.0`.</comment>

<file context>
@@ -138,7 +138,7 @@ controlplane:
     registry: ghcr.io
     repository: chainloop-dev/chainloop/control-plane
-    tag: "v1.81.2"
+    tag: "v1.82.0"
 
 
</file context>