fix(deps): bump github.com/cilium/ebpf from 0.11.0 to 0.22.0 in the gomod-security group across 1 directory

[dependabot]

Bumps the gomod-security group with 1 update in the / directory: github.com/cilium/ebpf.

Updates github.com/cilium/ebpf from 0.11.0 to 0.22.0

Release notes

Sourced from github.com/cilium/ebpf's releases.

v0.22.0: Linux 7.1 compat, BPF tokens and vmlinux BTF caching changes

Hi everyone! Today we announce the v0.22.0 release of ebpf-go. We ship Linux 7.1 compatibility, older versions of the library will not work on 7.1 kernels and above, so please upgrade if you are targeting the latest releases of Linux. We also made a breaking change to BTF caching, please read those notes. And of course a few fixes, improvements and minor features.

Kernel 7.1 compatibility

In kernel 7.1 the BTF header was extended to introduce a new feature called BTF layout. This change caused our BTF parser to fail when parsing vmlinux for this kernel. This has been fixed in this latest release, we recommend upgrading to this latest release to avoid breakage on 7.1 and newer kernels.

See cilium/ebpf#2042 for details. Special thanks to @​Capricornus007 for making the bug report that allowed us to fix this in a timely manner.

BPF token support

Some BPF-related actions require the user to have root privileges (CAP_SYS_ADMIN). One example is loading and attaching programs that can inspect kernel memory. In some environments, you may want to permit a known good process to load such BPF programs, but you don't want to grant it CAP_SYS_ADMIN to avoid privilege escalation if that process gets compromised.

BPF tokens are a mechanism that allows a privileged process to delegate fine-grained BPF capabilities to an unprivileged process. The process of delegating is complex and typically handled by a container runtime such as LXC or a process manager like systemd. This part of the handshake is currently out of scope of ebpf-go, as the library is not in charge of process creation where this delegation takes place.

However, the consuming side is what's included in this release. ebpf-go will automatically detect when the current process is running in a namespace where a BPF token is provided, and will automatically try to obtain an use it for interacting with the BPF syscall. Unlike libbpf, this currently requires no extra configuration on behalf of the application.

See cilium/ebpf#1953 for more details.

BTF cache changes

Package btf used to cache kernel (vmlinux) BTF specs globally. This is a significant time gain when loading multiple Collections in a row. However, doing so comes at a fairly significant memory cost (~20 MiB), so users could flush this cache with btf.FlushKernelSpec. Unfortunately, the caching behaviour being opt-out means users would typically discover it while investigating memory usage, and would then have to find an appropriate time during execution to call the flush function. This was always a band-aid for something we didn't have a clear solution to.

With this update, we've removed the global cache and the btf.FlushKernelSpec function, which may slow down subsequent collection loading on busy systems. To opt back in, users can now maintain their own cache object, obtained from btf.NewCache and pass it to NewCollectionWithOptions via CollectionOptions.Cache. Typically, you would put this in a global variable in a bpf-related package in your application, or keep it around in function scope if you load multiple collections in a row.

See cilium/ebpf#1988 for more details. Thank you @​matthyx for these changes.

New features

• btf: print member names of btf.Unions and Structs by @​ti-mo in cilium/ebpf#1967
• bpf2go: Generate constant names for maps, programs, and variables by @​mattijons in cilium/ebpf#1860
• Allow link.OpenExecutable for files without executable bit set by @​ti-mo in cilium/ebpf#1982
• asm: add support for the may_goto insn and JCOND opcode by @​mtardy in cilium/ebpf#1898

Bug fixes and improvements

• bpf2go: Improve error message when a C type cannot be resolved by @​awandke in cilium/ebpf#1965
• btf: reject nil values or interfaces from being added to Builder by @​ti-mo in cilium/ebpf#1966
• Use os.Getpagesize in tests instead of hardcoded 4k by @​shaunduncan in cilium/ebpf#1970
• map: avoid misleading error message for storage maps by @​venk8 in cilium/ebpf#1978
• struct_ops: Refactor struct_ops member population helpers by @​shun159 in cilium/ebpf#1986
• prog: restore btf.ErrNotFound behaviour of findTargetInKernel by @​ti-mo in cilium/ebpf#1991
• asm: fix wrong bpf call offset display for jited programs by @​wucm667 in cilium/ebpf#1996
• internal/kconfig: reject bool arrays for string values by @​immanuwell in cilium/ebpf#2006
• bpf2go: improve duplicate type name error message by @​wucm667 in cilium/ebpf#1993
• doc: clarify Address vs Offset on Uprobe/Uretprobe by @​Strykar in cilium/ebpf#2008
• fix(link): add missing BPF_F_REPLACE flag for RawAttachProgram by @​wucm667 in cilium/ebpf#1995
• tracefs: discover mount via /proc/self/mountinfo by @​yoav-orca in cilium/ebpf#2004
• prog.go: cache BTF for CAP_SYS_ADMIN-less freplace by @​mejedi in cilium/ebpf#2011
• BTF: fixed panics during parsing of malformed input by @​dylandreimerink in cilium/ebpf#2021

... (truncated)

Commits

• e55144e btf: Add BTF layout header parsing
• d37ad9c struct_ops_test: Fix TestCreateStructOpsMapSpecSimple
• 5e8bcc7 btf: Remove vmlinux dedup test
• f1eb026 Update kernel dependencies to 7.1
• 970a97d CODEOWNERS: allow reviewers to merge docs/, add rgo3 to link/
• 7be98ef variable: reject offsets that overflow uint32 bounds
• b404658 build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
• 63647bc build(deps): bump mkdocs-git-revision-date-localized-plugin
• e30ccb7 memory: use unsafe.Add to align unsafe memory instead of uintptr conversion
• 0e35955 Makefile: pre-create GOCACHE, GOPATH and GOMODCACHE for podman
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Semgrep Scan Results

Repository: api | Commit: cf7c328

Check	Status	Details
⚠️ Semgrep	Warning	2 warning(s), 6 total

Scanned at 2026-08-19 18:52 UTC

[github-actions]

Security Scan Results

Repository: api | Commit: cf7c328

Check	Status	Details
✅ Secret Scan	Pass	No secrets detected
⚠️ Dependencies (Trivy)	High	2 high, 3 total
⚠️ Dependencies (Grype)	High	2 high, 3 total
📦 SBOM	Generated	523 components (CycloneDX)

Scanned at 2026-08-19 18:53 UTC

[github-actions]

📊 Statement coverage

Measured on the documented included set (see docs/TESTING.md → Coverage scope). Observe-only — no regression gate is enforced yet.

Scope	This PR	main baseline	Δ
Included set (Gold-tier denominator)	89.6%	89.6%	+0.0 pp
Full set (whole repo, transparency)	28.5%	28.5%	+0.0 pp

Baseline: main @ e1f5c9d

[Cre-eD]

Superseded by #387, which makes the same cilium/ebpf 0.11.0 → 0.22.0 bump plus the fallout this PR would have hit on its own.

cilium/ebpf v0.22.0 names honnef.co/go/tools v0.7.0 in its own go.mod, so MVS raises it from v0.6.1. golangci-lint v1.64.8 does not compile against v0.7.0's analysis API — it panics mid-run and exits 7:

typedness: panic during analysis: interface conversion: interface {} is nil, not *buildir.IR
  honnef.co/go/tools@v0.7.0/analysis/facts/typedness/typedness.go:59

That fails the golangci-lint run step in branch.yaml / push.yaml / branch-preview.yaml. #387 pins honnef back with a replace directive (ebpf needs staticcheck for its CI, not for anything we compile, and a require line loses to ebpf's) and carries the removal condition in the go.mod comment.

#387 also closes GO-2026-6179 and GO-2026-6180 (golang.org/x/mod v0.38.0 → v0.40.0), which Dependabot did not raise an alert for but OpenSSF Scorecard, osv-scanner and trivy all report. Closing this one.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml