[Wolfi Package Update]: vcluster-syncer

[nfsouzaj]

Package name

vcluster-syncer

Current version in Wolfi

0.34.2-r0

Requested version

0.36.0

Upstream project URL

https://github.com/loft-sh/vcluster

Problem

The public Wolfi repositories currently expose vcluster-syncer only up to 0.34.2-r0, which blocks downstream apko builds that depend on public Wolfi package availability.

In our case, we build a vCluster image from public Wolfi packages and cannot move forward to newer upstream stable releases because the package is not yet published in the public Wolfi APK repositories.

Steps to reproduce

1. Query the public Wolfi package index or search the repositories for vcluster-syncer.
2. Observe that the latest public package version available is 0.34.2-r0.
3. Compare that with the latest stable upstream release at loft-sh/vcluster, which is v0.36.0.
4. Attempt to pin or resolve vcluster-syncer for 0.36.0 in an apko-based build and observe that the package cannot be resolved from the public Wolfi repositories.

Root cause (if known)

The public Wolfi package stream for vcluster-syncer appears to lag behind the latest stable upstream release. This prevents public consumers of Wolfi APKs from building against the latest stable vCluster release.

Proposed solution

Please update the existing Wolfi package vcluster-syncer to 0.36.0, assuming it fits Wolfi packaging and maintenance policy.

If there is a policy or technical reason why vcluster-syncer is intentionally capped at 0.34.2-r0, clarification would also help downstream consumers understand the expected support boundary.

Testing performed

• Verified the latest stable upstream release on loft-sh/vcluster is v0.36.0.
• Verified public Wolfi package availability stops at vcluster-syncer-0.34.2-r0.
• Confirmed this blocks downstream apko image builds that rely on public Wolfi repositories.

Acceptance criteria

• The requested version is the latest stable upstream release (no pre-releases or RCs)
• The upstream project uses an OSI-approved license
• The change aligns with Wolfi’s packaging and security model
• The package can be reasonably maintained over time
• There are no known unresolved security or supply-chain concerns

[amouat]

My understanding is that this package is not included in any of the free tier Chainguard Containers and is therefore no longer included in Wolfi. More details can be found here: https://github.com/wolfi-dev/#what-packages-are-included-in-wolfi

We apologise for any disruption this has caused. This package is available on a commercial basis or as part of a free trial.