v3.15.8

What's Changed

• PROJQUAY-12218: chore(deps): chore(deps): override js-yaml to address CVE-2026-59869 by @namansharma18899 in #6676
• [redhat-3.15] NO-ISSUE: fix(ci): pin s390x buildkit to v0.30.0 to avoid runc masking regression by @openshift-cherrypick-robot in #6705
• PROJQUAY-12359: fix(mirroring): prevent SSRF in repository sources by @redhat-chai-bot in #6721
• [redhat-3.15] PROJQUAY-12585: fix(cve): CVE-2026-56852 - x/text bump by @rhdmalone in #6849
• [redhat-3.15] PROJQUAY-12472: fix(cve): CVE-2026-69152 - brace-expansion by @alexissolanas in #6837
• [redhat-3.15] PROJQUAY-12478: fix(cve): CVE-2026-44705 - tmp by @alexissolanas in #6866
• [redhat-3.15] PROJQUAY-12431: fix(api): hide robot account tokens from global readonly superusers by @nindsimonv in #6860
• [redhat-3.15] PROJQUAY-12514: deps: Bump soupsieve to 2.8.4 by @nindsimonv in #6880
• [redhat-3.15] PROJQUAY-12736: fix(cve): CVE-2026-67320 - bump axios to 1.19.0 by @nindsimonv in #6923
• [redhat-3.15] PROJQUAY-12571: deps: Bump nanoid to 3.3.12 by @nindsimonv in #6928
• [redhat-3.15] PROJQUAY-12462: fix(cve): CVE-2026-69153 - postcss by @redhat-chai-bot in #6940
• [redhat-3.15] PROJQUAY-12584: fix(cve): CVE-2026-73089 - bump browserslist by @redhat-chai-bot in #6966
• v3.15.8 Changelog Bump by @github-actions[bot] in #7018

Full Changelog: v3.15.7...v3.15.8