From 519eca5ce19668b1877b35c820b540de50a409b9 Mon Sep 17 00:00:00 2001
From: stxkxs <139715017+stxkxs@users.noreply.github.com>
Date: Sat, 8 Aug 2026 12:53:00 -0700
Subject: [PATCH] chore(deps): opencost, reloader and trivy-operator to current
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three chart bumps whose rendered output does not change beyond the version
strings themselves.

  opencost        2.5.28 -> 2.5.29
  reloader        2.2.14 -> 2.2.15   (appVersion v1.4.19 -> v1.4.20)
  trivy-operator  0.34.0 -> 0.35.0   (appVersion 0.32.0 -> 0.33.0)

Batched together because they are the low-blast-radius end of the current
currency gap. The three that are not here are deliberately not here: cilium
crosses a CNI minor and takes its own change, the otel collector bump needs its
image pin resolved in the same commit or it opens a chart-ahead-of-image
divergence, and external-secrets 2.9.0 published today and sits inside the
shared preset's three-day minimumReleaseAge.

Verified by rendering rather than by reading the version numbers. Each chart was
templated at both versions against this repo's own base plus production values
and the outputs diffed: no object added, removed or renamed in any of the three,
and every changed line is a version string, an image tag, a chart label, or —
for trivy-operator — the config checksum that follows from them.

trivy-operator's appVersion moves a minor and it ships CRDs, which `helm
template` does not render and the render gate therefore cannot see. Both
versions were pulled and their crds/ directories compared directly: twelve files
each, byte-identical. This matters because ArgoCD syncs these with
ServerSideApply and no skipCrds, so a CRD change here applies fleet-wide without
passing through any gate in this repo.

task validate passes: 109 addon×env combinations, 0 failed.
---
 applicationsets/addons-bootstrap.yaml | 2 +-
 applicationsets/addons-opencost.yaml  | 2 +-
 applicationsets/addons-security.yaml  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/applicationsets/addons-bootstrap.yaml b/applicationsets/addons-bootstrap.yaml
index 1be29f5..3da1d48 100644
--- a/applicationsets/addons-bootstrap.yaml
+++ b/applicationsets/addons-bootstrap.yaml
@@ -49,7 +49,7 @@ spec:
                   namespace: reloader
                   chartRepo: https://stakater.github.io/stakater-charts
                   chart: reloader
-                  chartVersion: "2.2.14"
+                  chartVersion: "2.2.15"
                   path: addons/bootstrap/reloader
                   syncWave: "2"
   template:
diff --git a/applicationsets/addons-opencost.yaml b/applicationsets/addons-opencost.yaml
index 422a3b3..4abc437 100644
--- a/applicationsets/addons-opencost.yaml
+++ b/applicationsets/addons-opencost.yaml
@@ -45,7 +45,7 @@ spec:
       sources:
         - repoURL: https://opencost.github.io/opencost-helm-chart
           chart: opencost
-          targetRevision: "2.5.28"
+          targetRevision: "2.5.29"
           helm:
             releaseName: opencost
             valueFiles:
diff --git a/applicationsets/addons-security.yaml b/applicationsets/addons-security.yaml
index 2fd53b0..1671cff 100644
--- a/applicationsets/addons-security.yaml
+++ b/applicationsets/addons-security.yaml
@@ -34,7 +34,7 @@ spec:
                   namespace: trivy-system
                   chartRepo: https://aquasecurity.github.io/helm-charts
                   chart: trivy-operator
-                  chartVersion: 0.34.0
+                  chartVersion: 0.35.0
                   path: addons/security/trivy-operator
                   syncWave: "11"
                 - appName: falco