ROX-36126: pin v3 stream to release-4.11 with source filtering

[jvdm]

Description

Pin the v3 vulnerability bundle stream from a pre-source-filtering SHA (e83e6e51) to the current release-4.11 tip (2e8d7a35), which includes source filtering (PR #21791). This is required for the per-updater scheduling workflow to correctly filter sources when building v3 updaters.

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

Verified that SHA 2e8d7a35 resolves to v3 in scanner/VULNERABILITY_VERSION and that scanner/updater/export.go at that SHA includes the filterSources function.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: d26fe5fd-93cf-413d-82fa-983fe7f430fe

📥 Commits

Reviewing files that changed from the base of the PR and between 3612fc6 and 57c982d.

📒 Files selected for processing (1)

• scanner/updater/version/VULNERABILITY_BUNDLE_VERSION

🚧 Files skipped from review as they are similar to previous changes (1)

• scanner/updater/version/VULNERABILITY_BUNDLE_VERSION

---

📝 Walkthrough

Summary by CodeRabbit

• Enhancements
  • Updated the vulnerability bundle used by Scanner to a newer release, providing the latest available vulnerability definitions and detection updates.
  • The refreshed bundle is associated with the Scanner 4.11 release cycle and is scheduled for August 6, 2026.
  • Scanning results will reflect the updated vulnerability information once the new bundle is available.

Walkthrough

The v3 vulnerability bundle reference now points to commit 2e8d7a35b1200eb29d5a75cad2a443719cf265e1. The file includes a Scanner 4.11 release annotation dated 2026-08-06.

Changes

Vulnerability bundle update

Layer / File(s)	Summary
Update v3 bundle reference scanner/updater/version/VULNERABILITY_BUNDLE_VERSION	The v3 bundle reference changed to the new commit. The Scanner 4.11 release annotation was added.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the v3 stream pin, target release, and source-filtering change.
Description check	✅ Passed	The description explains the change, purpose, validation, documentation status, and absence of automated tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jvdm/rox-33377-pin-v3-stream

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[github-actions]

🚀 Build Images Ready

Images are ready for commit fb83afb. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.12.x-706-gfb83afbc84

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.27%. Comparing base (9752b60) to head (fb83afb).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #22150      +/-   ##
==========================================
- Coverage   51.30%   51.27%   -0.04%     
==========================================
  Files        2867     2867              
  Lines      179352   179352              
==========================================
- Hits        92024    91963      -61     
- Misses      79255    79299      +44     
- Partials     8073     8090      +17     

Flag	Coverage Δ
go-unit-tests	51.27% <ø> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[openshift-ci]

@jvdm: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp-4-12-scanner-v4-install-tests	fb83afb	link	false	/test ocp-4-12-scanner-v4-install-tests
ci/prow/ocp-4-12-nongroovy-e2e-tests	fb83afb	link	false	/test ocp-4-12-nongroovy-e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.