chore(all): update deps (major)

.github/linters/.codespellrc

@@ -0,0 +1,2 @@
+[codespell]
+skip = *.sum,*.lock,*.lock.json,go.work.sum,go.sum,MODULE.bazel.lock

.github/linters/.trivyignore

@@ -0,0 +1,8 @@
+# Trivy ignore file
+# KSV-0056: The Lemming Kubernetes Operator controller manager requires permissions
+# to create/delete/manage pods, secrets, and services for virtual network devices.
+AVD-KSV-0056
+KSV-0056
+
+# GO-2026-5932: golang.org/x/crypto/openpgp is deprecated upstream
+GO-2026-5932

.github/linters/trivy.yaml

@@ -0,0 +1,2 @@
+scanners:
+  - vuln

.github/workflows/buildtest.yml

@@ -12,21 +12,24 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
----
 name: Build and Test
 on:
   push:
     branches: [main]
   pull_request:
+permissions:
+  contents: read
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
-      - name: Restore Bazel Cache 
-        uses: actions/cache/restore@v3
+        uses: bazel-contrib/setup-bazel@e8776f58fb6a6e9055cbaf1b38c52ccc5247e9c4 # 0.14.0
+      - name: Restore Bazel Cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cache/bazel
@@ -47,7 +50,7 @@ jobs:
       - name: Build Lemming
         run: bazel build //...
       - name: Save Bazel Cache
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: github.ref == 'refs/heads/main'
         with:
           path: |
@@ -56,11 +59,13 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
-      - name: Restore Bazel Cache 
-        uses: actions/cache/restore@v3
+        uses: bazel-contrib/setup-bazel@e8776f58fb6a6e9055cbaf1b38c52ccc5247e9c4 # 0.14.0
+      - name: Restore Bazel Cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cache/bazel
@@ -81,14 +86,14 @@ jobs:
       - name: Test
         run: make coverage
       - name: Coveralls
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
         with:
           file: bazel-out/_coverage/_coverage_report.dat
           format: lcov
       - run: |
           make test-race
       - name: Save Bazel Cache
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: github.ref == 'refs/heads/main'
         with:
           path: |

.github/workflows/generatedcode.yml

@@ -11,18 +11,20 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
----
 name: Check Generate Code
 on:
   pull_request:
+permissions:
+  contents: read
 jobs:
   gazelle:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
+        uses: bazel-contrib/setup-bazel@e8776f58fb6a6e9055cbaf1b38c52ccc5247e9c4 # 0.14.0
       - name: Run Gazelle
         run: bazel run //:gazelle
       - name: Check Diff
@@ -35,11 +37,13 @@ jobs:
   protos:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
+        uses: bazel-contrib/setup-bazel@e8776f58fb6a6e9055cbaf1b38c52ccc5247e9c4 # 0.14.0
       - name: Cache Bazel
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cache/bazel
@@ -54,4 +58,4 @@ jobs:
             # MODULE.bazel.lock file can change due to rules_python dependency packages.
             git diff HEAD -- ':(exclude)MODULE.bazel.lock'
             exit 1
-          fi
+          fi

.github/workflows/golangci-lint.yml

@@ -29,17 +29,22 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.26.2
           cache: false
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Install pcap
         run: |
           sudo apt-get install libpcap-dev libnl-genl-3-dev libnl-3-dev
       - name: golangci-lint
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        env:
+          CGO_ENABLED: 1
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
           version: latest
+          install-mode: goinstall
           only-new-issues: true

.github/workflows/linter.yml

@@ -20,26 +20,34 @@ on:
     # Remove the line above to run when pushing to master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Lint Code Base
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Lint Code Base
-        uses: github/super-linter/slim@v4
+        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
         env:
           VALIDATE_ALL_CODEBASE: false
           VALIDATE_JSCPD: false
           VALIDATE_GO: false
+          VALIDATE_GO_MODULES: false
           VALIDATE_CLANG_FORMAT: false
           VALIDATE_KUBERNETES_KUBEVAL: false
+          VALIDATE_CHECKOV: false
+          VALIDATE_BIOME_FORMAT: false
+          VALIDATE_BIOME_LINT: false
           VALIDATE_GITLEAKS: false
           IGNORE_GENERATED_FILES: true
           DEFAULT_BRANCH: main
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          FILTER_REGEX_EXCLUDE: (Dockerfile.*dockerignore|dataplane/standalone/sai|configs/bullseye) # Linter thinks these are docker files but they aren't.
+          FILTER_REGEX_EXCLUDE: (Dockerfile.*dockerignore|dataplane/standalone/sai|configs/bullseye|.*\.sum$|.*\.lock$) # Linter thinks these are docker files but they aren't.

Dockerfile.lemming

@@ -14,12 +14,12 @@ FROM build as debug-build
 RUN go install github.com/go-delve/delve/cmd/dlv@latest
 RUN --mount=type=cache,target=/root/.cache/go-build go build -gcflags='all=-N -l' -o /out/lemming ./cmd/lemming
 
-FROM docker.io/debian:bookworm as debug
-RUN apt-get update && apt-get install -y libpcap-dev ca-certificates
+FROM docker.io/debian:bookworm-slim as debug
+RUN apt-get update && apt-get install -y --no-install-recommends libpcap-dev ca-certificates && rm -rf /var/lib/apt/lists/*
 COPY --from=debug-build /out/lemming /lemming/lemming
 COPY --from=debug-build /go/bin/dlv /dlv/dlv
 
-FROM docker.io/debian:bookworm as release
-RUN apt-get update && apt-get install -y libpcap-dev ca-certificates
+FROM docker.io/debian:bookworm-slim as release
+RUN apt-get update && apt-get install -y --no-install-recommends libpcap-dev ca-certificates && rm -rf /var/lib/apt/lists/*
 COPY --from=release-build /out/lemming /lemming/lemming
 COPY --from=release-build /build/THIRD_PARTY_LICENSES /lemming/THIRD_PARTY

Dockerfile.saibuilder

@@ -1,4 +1,4 @@
-FROM debian:bookworm
+FROM debian:bookworm-slim
 
 # Install required build packages and development libraries
 RUN apt-get update && apt-get install -y --no-install-recommends \

MODULE.bazel

@@ -7,6 +7,7 @@ bazel_dep(name = "abseil-cpp", version = "20240722.0.bcr.2")
 bazel_dep(name = "gazelle", version = "0.45.0", repo_name = "bazel_gazelle")
 bazel_dep(name = "glog", version = "0.7.1", repo_name = "com_github_google_glog")
 bazel_dep(name = "googleapis", version = "0.0.0-20240819-fe8ba054a")
+bazel_dep(name = "boringssl", version = "0.20250114.0")
 bazel_dep(name = "grpc", version = "1.70.1", repo_name = "com_github_grpc_grpc")
 bazel_dep(name = "openconfig_gnmi", version = "0.14.1", repo_name = "com_github_openconfig_gnmi")
 bazel_dep(name = "p4runtime", version = "0.0.0", repo_name = "p4runtime_protos")

WORKSPACE

@@ -65,24 +65,24 @@ http_archive(
 
 http_archive(
     name = "com_google_absl",
-    sha256 = "b396401fd29e2e679cace77867481d388c807671dc2acc602a0259eeb79b7811",
-    strip_prefix = "abseil-cpp-20250127.1",
+    sha256 = "71358f2e72e945d280bfab44090eacb3f98e10fead31fd97876f05a835510d92",
+    strip_prefix = "abseil-cpp-20250512.2",
     urls = [
-        "https://github.com/abseil/abseil-cpp/releases/download/20250127.1/abseil-cpp-20250127.1.tar.gz",
+        "https://github.com/abseil/abseil-cpp/releases/download/20250512.2/abseil-cpp-20250512.2.tar.gz",
     ],
 )
 
 http_archive(
     name = "build_bazel_rules_swift",
-    sha256 = "4901feadef8e47ede930c95c40298dd38a83a81eb1ed5b74e62abfa546ff2d1b",
-    url = "https://github.com/bazelbuild/rules_swift/releases/download/2.8.1/rules_swift.2.8.1.tar.gz",
+    sha256 = "0814d7513a3a18c2fedca69d44ee35b41168ae10e24ba50ec711e496e82ae3eb",
+    url = "https://github.com/bazelbuild/rules_swift/releases/download/4.0.1/rules_swift.4.0.1.tar.gz",
 )
 
 http_archive(
     name = "rules_proto_grpc",
-    sha256 = "fb7fc7a3c19a92b2f15ed7c4ffb2983e956625c1436f57a3430b897ba9864059",
-    strip_prefix = "rules_proto_grpc-4.3.0",
-    urls = ["https://github.com/rules-proto-grpc/rules_proto_grpc/archive/4.3.0.tar.gz"],
+    sha256 = "a25b9992ded30441b0250b2a3e69638e94e664bffcbd77daac6dd355fc92dd17",
+    strip_prefix = "rules_proto_grpc-5.8.0",
+    urls = ["https://github.com/rules-proto-grpc/rules_proto_grpc/archive/5.8.0.tar.gz"],
 )
 
 http_archive(
@@ -105,9 +105,9 @@ http_archive(
 
 http_archive(
     name = "rules_proto",
-    sha256 = "303e86e722a520f6f326a50b41cfc16b98fe6d1955ce46642a5b7a67c11c0f5d",
-    strip_prefix = "rules_proto-6.0.0",
-    url = "https://github.com/bazelbuild/rules_proto/releases/download/6.0.0/rules_proto-6.0.0.tar.gz",
+    sha256 = "14a225870ab4e91869652cfd69ef2028277fc1dc4910d65d353b62d6e0ae21f4",
+    strip_prefix = "rules_proto-7.1.0",
+    url = "https://github.com/bazelbuild/rules_proto/releases/download/7.1.0/rules_proto-7.1.0.tar.gz",
 )
 
 http_archive(

dataplane/standalone/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:bullseye
+FROM debian:trixie
 RUN apt-get update && apt-get install -y --no-install-recommends build-essential=12.9 clang=1:11.0-51+nmu5 \
     wget=1.21-1+deb11u1 protobuf-compiler=3.12.4-1+deb11u1 protobuf-compiler-grpc=1.30.2-3 \
     libgrpc++-dev=1.30.2-3 libgoogle-glog-dev=0.4.0-4 git=1:2.30.2-1+deb11u2 openjdk-11-jdk=11.0.22+7-1~deb11u1 \