Affected by GO-2026-4407 and 4 other vulnerabilities

GO-2026-4407: melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

GO-2026-4408: melange pipeline working-directory could allow command injection in chainguard.dev/melange

GO-2026-4409: melange has a path traversal in license-path which allows reading files outside workspace in chainguard.dev/melange

GO-2026-4412: melange affected by potential host command execution via license-check YAML mode patch pipeline in chainguard.dev/melange

GO-2026-4588: `melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange

cache

package

v0.33.1 Latest Latest Go to latest Published: Nov 12, 2025 License: Apache-2.0 Imports: 16 Imported by: 0

Details

This section is empty.

This section is empty.

func New(opts ...Option) renovate.Renovator

New returns a renovator which fetches cache dependencies.

type CacheConfig struct {
	CacheDir string
	// contains filtered or unexported fields
}

CacheConfig contains the configuration data for a bump renovator.

type Option func(cfg *CacheConfig) error

Option sets a config option on a CacheConfig.

func WithCacheDir(cacheDir string) Option

WithCacheDir sets the desired target directory for cache artifacts to be fetched to.