Merge pull request #94 from rad-security/security/bump-runtime-v0.1.47-sbom-v1.1.71

Bump rad-runtime to v0.1.47 and rad-sbom to v1.1.71

Author: mateuszdyminski

stable/rad-plugins/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: rad-plugins
-version: 2.4.14
+version: 2.4.15
 description: A Helm chart to run the RAD Security plugins
 home: https://rad.security
 icon: https://app.rad.security/assets/favicon.svg
@@ -18,9 +18,11 @@ annotations:
   # Possible kind options are added, changed, deprecated, removed, fixed and security.
   artifacthub.io/changes: |
     - kind: security
-      description: Bump all plugin images to Go 1.27.1 to fix the Go toolchain vulnerabilities reported against the previous 1.26.7 builds
+      description: Bump rad-runtime and rad-runtime-exporter to v0.1.47 for google.golang.org/grpc, containerd, docker/moby, cilium/ebpf, gopacket, oras-go, otel, golang.org/x/text and klauspost/compress vulnerabilities (containerd moved to v2, docker to the moby/moby client)
     - kind: security
-      description: Bump rad-guard to v1.1.44 for golang.org/x/crypto CVE-2026-56854 and rad-sbom to v1.1.70 for google.golang.org/grpc CVE-2026-84304
+      description: Bump rad-sbom to v1.1.71 for google.golang.org/grpc GHSA-2v4p-qf9q-27wj, containerd GHSA-7jxh-36q5-gcqv, otel/sdk GHSA-8wmf-6v46-5gfg, klauspost/compress GO-2026-5841 and golang.org/x/crypto GO-2026-5932
+    - kind: fixed
+      description: rad-runtime socket enricher falls back to eBPF address resolution when /proc/kallsyms hides kernel addresses, so connections on sockets opened before the agent started are attributed to their process
   artifacthub.io/containsSecurityUpdates: "true"
   artifacthub.io/links: |
     - name: source

stable/rad-plugins/README.md

@@ -651,7 +651,7 @@ The command removes all the Kubernetes components associated with the chart and
 | runtime.agent.grpcServerBatchSize | int | `2000` |  |
 | runtime.agent.hostPID | string | `nil` |  |
 | runtime.agent.image.repository | string | `"public.ecr.aws/n8h5y2v5/rad-security/rad-runtime"` |  |
-| runtime.agent.image.tag | string | `"v0.1.46"` |  |
+| runtime.agent.image.tag | string | `"v0.1.47"` |  |
 | runtime.agent.mounts.volumeMounts | list | `[]` |  |
 | runtime.agent.mounts.volumes | list | `[]` |  |
 | runtime.agent.resources.limits.cpu | string | `"200m"` |  |
@@ -677,7 +677,7 @@ The command removes all the Kubernetes components associated with the chart and
 | runtime.exporter.env.LOG_LEVEL | string | `"INFO"` |  |
 | runtime.exporter.execFilters | list | `[]` | Allows to specify wildcard rules for filtering command arguments. |
 | runtime.exporter.image.repository | string | `"public.ecr.aws/n8h5y2v5/rad-security/rad-runtime-exporter"` |  |
-| runtime.exporter.image.tag | string | `"v0.1.46"` |  |
+| runtime.exporter.image.tag | string | `"v0.1.47"` |  |
 | runtime.exporter.resources.limits.cpu | string | `"500m"` |  |
 | runtime.exporter.resources.limits.ephemeral-storage | string | `"1Gi"` |  |
 | runtime.exporter.resources.limits.memory | string | `"1Gi"` |  |
@@ -734,7 +734,7 @@ The command removes all the Kubernetes components associated with the chart and
 | sbom.ephemeralVolumes.size | string | `"25Gi"` | Storage size for SBOM ephemeral volume (larger size recommended for image processing) |
 | sbom.ephemeralVolumes.storageClassName | string | `""` | Storage class to use. Use "" for default storage class, "-" for no storage class |
 | sbom.image.repository | string | `"public.ecr.aws/n8h5y2v5/rad-security/rad-sbom"` | The image to use for the rad-sbom deployment |
-| sbom.image.tag | string | `"v1.1.70"` |  |
+| sbom.image.tag | string | `"v1.1.71"` |  |
 | sbom.labels | object | `{}` |  |
 | sbom.nodeSelector | object | `{}` |  |
 | sbom.podAnnotations | object | `{}` |  |

stable/rad-plugins/values.yaml

@@ -123,7 +123,7 @@ sbom:
   image:
     # -- The image to use for the rad-sbom deployment
     repository: public.ecr.aws/n8h5y2v5/rad-security/rad-sbom
-    tag: v1.1.70
+    tag: v1.1.71
   env:
     # -- Whether to mutate the image in pod spec by adding digest at the end. By default, digests are added to images to ensure
     # that the image that runs in the cluster matches the digest of the build.  Disable this if your continuous deployment
@@ -294,7 +294,7 @@ runtime:
         kube-system
     image:
       repository: public.ecr.aws/n8h5y2v5/rad-security/rad-runtime
-      tag: v0.1.46
+      tag: v0.1.47
     resources:
       limits:
         cpu: 200m
@@ -344,7 +344,7 @@ runtime:
 
     image:
       repository: public.ecr.aws/n8h5y2v5/rad-security/rad-runtime-exporter
-      tag: v0.1.46
+      tag: v0.1.47
 
     # -- Allows to specify wildcard rules for filtering command arguments.
     execFilters: []