chore(deps): update devbox packages

[renovate]

This PR contains the following updates:

Package	Update	Change
checkov	patch	3.2.521 → 3.2.525
eslint	patch	10.2.0 → 10.2.1
grype	minor	0.108.0 → 0.111.1
kubectl	minor	1.35.3 → 1.36.0
kubernetes-helm	patch	3.20.1 → 3.20.2
skopeo	patch	1.22.1 → 1.22.2

---

Release Notes

bridgecrewio/checkov (checkov)

v3.2.525

Compare Source

Bug Fix

• terraform: fix wrong windows path - #​7529

v3.2.524

Compare Source

Bug Fix

• general: Revert Switch Terraform regex eval to RE2 for better performance - #​7520
• sca: Align ImageScanner.run_image_scan with execute_scan - #​7518

anchore/grype (grype)

v0.111.1

Bug Fixes

• apply overlap by ownership removal to dynamically created relationships [#​3363 @​kzantow]
• compare mismatched package / db versions [#​3372 @​kzantow]
• Grype doesn't recognize debian component when "group" : "debian" is specified [#​2967]
• HelpURI missing information in SARIF output [#​2874 #​3351 @​will-bates11]

(Full Changelog)

kubernetes/kubectl (kubectl)

v1.36.0

v1.35.4

helm/helm (kubernetes-helm)

v3.20.2: Helm v3.20.2

v3.20.2

Helm v3.20.2 is a security patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

• GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

Installation and Upgrading

Download Helm v3.20.2. The common platform binaries are here:

• MacOS amd64 (checksum / 7de04301f28b902a74f6286ed941cadc86ee5e6a9086a18f2ccf1f548e99d618)
• MacOS arm64 (checksum / 139c794c22f16b579d08ddd3008c8038b9bb2814f35b5bcca91f50a1f458978d)
• Linux amd64 (checksum / 258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea)
• Linux arm (checksum / a8a614c740399ff1ef32bcea6be6e4523f17e3376f9cf55c192cc48c8f2d1f19)
• Linux arm64 (checksum / 5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691)
• Linux i386 (checksum / 88e4c1834307cdbc9f3b80920e1a383e4ba50bb488fb0be1b1fbd4918bb6ae73)
• Linux ppc64le (checksum / 98bb26a2f3c0b0c1a50db3181dff192554e0c204a07427d98d6b01e259f23cbe)
• Linux s390x (checksum / 584dd77ef8096d6ef939a1822f72840e749fc8311b2b13ae94df5f786862a56b)
• Linux riscv64 (checksum / 957391d0710d72678acd09959b5dc77888cd007a78a4b99944d3b2fc7e1895ca)
• Windows amd64 (checksum / 24e8e5b71bab4ee17e6f989931ecf4fb144f9916cbe9990c0b6b2ec7b925c454)
• Windows arm64 (checksum / 7c940a73a6882f50b69aec3282549da4a49917669db18fc503db930fb74b9789)

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
• 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

• fix: Chart dot-name path bug 8fb76d6 (George Jenkins)
• fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 3a8927e (Terry Howe)

containers/skopeo (skopeo)

v1.22.2

What's Changed

• Fixes signature verification of images which only sign the per-platform manifest in skopeo proxy, by @​wking in #​2847

New Contributors

• @​wking made their first contribution in #​2847

Full Changelog: podman-container-tools/skopeo@v1.22.1...v1.22.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.