chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
dracut	049-244.git20260529.el8_10 -> 049-246.git20260728.el8_10
kernel-headers	4.18.0-553.154.1.el8_10 -> 4.18.0-553.155.1.el8_10

---

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

CVE-2026-15816

More information

Details

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-15816
• https://bugzilla.redhat.com/show_bug.cgi?id=2500889
• https://www.cve.org/CVERecord?id=CVE-2026-15816
• https://nvd.nist.gov/vuln/detail/CVE-2026-15816
• https://bugzilla.redhat.com/show_bug.cgi?id=2459963
• https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh
• https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.61%. Comparing base (bd1c49c) to head (5a18ec6).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-3.23    #3360   +/-   ##
=============================================
  Coverage         27.61%   27.61%           
=============================================
  Files                96       96           
  Lines              5424     5424           
  Branches           2523     2523           
=============================================
  Hits               1498     1498           
  Misses             3214     3214           
  Partials            712      712           

Flag	Coverage Δ
collector-unit-tests	27.61% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.