NO-ISSUE: Refresh RPM lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci-robot]

@red-hat-konflux[bot]: This pull request explicitly references no jira issue.

Details

In response to this:

This PR contains the following updates:

File rpm-prefetching/rpms.in.yaml:

Package	Change
aardvark-dns	2:1.17.0-1.el9 -> 2:1.17.1-1.el9_8
podman	6:5.8.2-3.el9_8 -> 6:5.8.2-5.el9_8
python-unversioned-command	3.9.25-7.el9_8 -> 3.9.25-7.el9_8.2
python3	3.9.25-7.el9_8 -> 3.9.25-7.el9_8.2
python3-libs	3.9.25-7.el9_8 -> 3.9.25-7.el9_8.2

---

[!WARNING]
Some dependencies could not be looked up. Check the warning logs for more information.

---

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

CVE-2026-15308

More information

Details

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-15308
• https://bugzilla.redhat.com/show_bug.cgi?id=2498608
• https://www.cve.org/CVERecord?id=CVE-2026-15308
• https://nvd.nist.gov/vuln/detail/CVE-2026-15308
• https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
• https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
• https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
• https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
• https://github.com/python/cpython/issues/153030
• https://github.com/python/cpython/pull/153031
• https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
• At any time (no schedule defined)
• Automerge
• At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The RPM lockfile refreshes conmon, passt, sg3_utils, and sg3_utils-libs metadata for aarch64, ppc64le, s390x, and x86_64.

Changes

RPM lock metadata refresh

Layer / File(s)	Summary
Refresh conmon records rpm-prefetching/rpms.lock.yaml	Updates conmon from 2.2.1-1.el9 to 2.2.1-2.el9 across all four architectures.
Refresh passt records rpm-prefetching/rpms.lock.yaml	Updates passt from -5.el9_8 to -6.el9_8 across all four architectures.
Refresh sg3_utils records rpm-prefetching/rpms.lock.yaml	Updates sg3_utils and sg3_utils-libs to 1.47-10.el9_8.1 across all four architectures.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/assisted-installer-agent#1351: Refreshes RPM lockfile metadata across architectures.
• openshift/assisted-installer-agent#1355: Refreshes metadata in the same RPM lockfile.
• openshift/assisted-installer-agent#1590: Refreshes the same lockfile entries across the same architectures.

Suggested reviewers: jhernand, rccrdpccl

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only rpm-prefetching/rpms.lock.yaml; no test files or Ginkgo title calls changed, so no unstable test names were introduced.
Test Structure And Quality	✅ Passed	The pull request changes only an RPM lockfile; no Ginkgo test code, test files, cluster operations, or assertions are added or modified.
Microshift Test Compatibility	✅ Passed	The pull request changes only rpm-prefetching/rpms.lock.yaml and adds no Ginkgo e2e tests or MicroShift-incompatible API usage.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only rpm-prefetching/rpms.lock.yaml; it adds no Ginkgo e2e tests or other test code requiring SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	The only changed path is rpm-prefetching/rpms.lock.yaml, and the diff contains RPM URLs and metadata only; no manifests, controllers, or scheduling constraints changed.
Ote Binary Stdout Contract	✅ Passed	The PR changes only rpm-prefetching/rpms.lock.yaml; no process-level source code or stdout writes are present.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only rpm-prefetching/rpms.lock.yaml; no Ginkgo or e2e test code was added, so this compatibility check is not applicable.
No-Weak-Crypto	✅ Passed	The patch only refreshes RPM metadata and SHA-256 checksums; no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, crypto code, or secret comparisons were added.
Container-Privileges	✅ Passed	The PR changes only RPM metadata in rpm-prefetching/rpms.lock.yaml; added lines contain no privilege controls or container/Kubernetes manifest settings.
No-Sensitive-Data-In-Logs	✅ Passed	The commit changes only the RPM lockfile; added values are public cdn.redhat.com URLs, package metadata, sizes, and SHA-256 checksums, with no logging or sensitive credentials.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the RPM lockfile refresh and identifies its security purpose.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/master/lock-file-maintenance-rpm-lockfile-refresh-vulnerability

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD f84fd71 and 2 for PR HEAD e805b83 in total

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD bfa655c and 1 for PR HEAD e805b83 in total

[openshift-ci]

New changes are detected. LGTM label has been removed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.66%. Comparing base (aeec165) to head (3a04094).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1545      +/-   ##
==========================================
+ Coverage   56.61%   56.66%   +0.04%     
==========================================
  Files          90       90              
  Lines        4654     4654              
==========================================
+ Hits         2635     2637       +2     
+ Misses       1814     1813       -1     
+ Partials      205      204       -1     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-ci]

@red-hat-konflux[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.