Description of the patch:
This update for aws-iam-authenticator fixes the following issues
- CVE-2022-1996: CORS bypass (bsc#1200528).
- CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass (bsc#1201395).
- CVE-2024-39689: remove root certificates from
GLOBALTRUST from the root store.
- CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad.
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265842).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266651).
Changes for aws-iam-authenticator:
- Merge pull request (#1062) from CaidenBorrego/new-release
- Creating new release for CVE mitigation
- Merge pull request (#1057) from CaidenBorrego/caidenb-versionbump
- Merge remote-tracking branch 'upstream/master' into caidenb-versionbump
- Bump x/net and x/sys to remediate CVEs (bsc#1266651, CVE-2026-39821)
- Merge pull request #1051 from CaidenBorrego/caidenb-versionbump
- bumping version from 0.7.16->0.7.17
- Merge pull request #1047 from CaidenBorrego/caidenb-reservedprefix-fix
- fix: honor reservedPrefixConfig for ConfigMap and CRD backends
- Merge pull request #1046 from CaidenBorrego/caidenb-gorunner-bump
- fix: reject malformed mapping ARN in userIDStrict mode for dynamic files
- Merge pull request #1041 from ronaldngounou/rngounou/bump-go-1.26.3
- Pin GitHub Actions to full-length commit SHAs
- fix: bump go version to 1.26.3 for CVEs
- Merge pull request #1035 from Ganiredi/bump-version-0.7.15
- Bump version to 0.7.15
- Merge pull request #1030 from Ganiredi/1.36-k8s-deps
- 1.36.0 dependency update
- Merge pull request #1029 from CaidenBorrego/caidenb-gorunner-bump
- Bump version to 0.7.14
- Bumping gorunner image...