Monthly GLSA metadata 2025-10-01

[flatcar-infra]

Updated GLSA metadata

[krnowak]

Oi, this should have been put on hold - this will likely make the nightly builds fail, because we are still having the old pam version and this will trigger the GLSA check. Let's see.

[github-actions]

Build action triggered: https://github.com/flatcar/scripts/actions/runs/18345308847

[chewi]

Sorry, I thought it was harmless. 😢 I think PRs like this need a note about what we should check or watch out for when merging.

[tormath1]

So yeah the CI is failing because:

 This system is affected by the following GLSAs:
 202508-01
 202505-01

Let's revert this commit while PAM issue is being addressed.

EDIT: #3337

[dongsupark]

Just FYI, we have 2 options:

1. Do not update GLSA metadata, a.k.a. keep such bot PRs open until pam could be updated. Basically what we already do.
2. Add the 2 GLSAs to GLSA_ALLOWLIST, to avoid such CI failures. I am fine with this approach as well, as long as the pam update seems not so trivial.

[krnowak]

Let's go with 1. I'm working on the PAM update.