lgtm-stack 0.0.21 Helm chart

Name: lgtm-stack Helm chart 0.0.21: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

quench-lgtm-stack

Scored 26 Sept 2026

Hardened, operator-free LGTM observability superset in one install: Loki (logs) + Grafana (the single pane) + Tempo (traces) + VictoriaMetrics (Prometheus-compatible metrics) + an OpenTelemetry Collector (OTLP ingest) + Alertmanager. Grafana gets three pre-provisioned datasources — VictoriaMetrics (default), Loki, Tempo — so metrics, logs and traces are explorable side by side out of the box. VictoriaMetrics scrapes pods via annotation-based service discovery; Vector ships every pod's logs to Loki; apps send OTLP traces to the collector, which forwards to Tempo. No operator, no CRDs. All component images are QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed. node-exporter and Vector take host access by design (cluster metrics + logs); both are toggleable.

Version 0.0.21app version 1.0.0 (not verified against the render) 0Artifact Hub

lgtm-stack 0.0.21 deploys 9 container images: ghcr.io/quenchworks/images/node-exporter, ghcr.io/quenchworks/images/vector, ghcr.io/quenchworks/images/kube-state-metrics, ghcr.io/quenchworks/images/otel-collector and 5 more. Across them, 78 findings — 0 critical, 0 high. The highest contribution is GHSA-vp52-pcj8-j9qc in google.golang.org/grpc v1.82.1, fixed in 1.83.1.

Radar Score

48400276

78 findings over 9 of 9 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

9 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/quenchworks/images/node-exporter	digest-pinned	0001	4
ghcr.io/quenchworks/images/vector	digest-pinned	0006	32
ghcr.io/quenchworks/images/kube-state-metrics	digest-pinned	0005	15
ghcr.io/quenchworks/images/otel-collector	digest-pinned	0008	46
ghcr.io/quenchworks/images/alertmanager	digest-pinned	0006	20
ghcr.io/quenchworks/images/grafana	digest-pinned	00024	169
ghcr.io/quenchworks/images/loki	digest-pinned	0007	40
ghcr.io/quenchworks/images/tempo	digest-pinned	00216	137
ghcr.io/quenchworks/images/victoriametrics	digest-pinned	0003	21

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

28 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	GHSA-2v4p-qf9q-27wj	google.golang.org/grpc@v1.82.1	1.82.2
Low	GHSA-p4r4-xvrq-gvmc	github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0	2.8.4
Low	CGA-35fq-7ggc-gcf2	glibc-2.44@2.44-r1	2.44-r4
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.82.1	1.83.1
Low	GHSA-w34q-cm8f-9c5x	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.19.0	0.21.0
Low	GHSA-ffqx-q65f-36jf	github.com/grafana/tempo@v1.5.1-0.20260427112133-525d1bab07e0	2.10.3
Low	GHSA-g3pg-frfm-pr2m	github.com/openfga/openfga@v1.18.0	1.18.1
Low	GO-2026-6107	go.etcd.io/etcd/client/pkg/v3@v3.6.9	3.5.33
Low	GO-2026-6355	golang.org/x/crypto@v0.55.0	0.56.0
Low	GO-2026-6354	golang.org/x/crypto@v0.55.0	0.56.0
Low	CGA-32c9-fmx5-865m	glibc-2.44@2.44-r6	no fix listed
Low	CGA-86q6-jgw4-4qvq	glibc-2.44@2.44-r6	no fix listed
Low	GO-2022-0646	github.com/aws/aws-sdk-go@v1.55.8	no fix listed
Low	CGA-3p64-pj6v-586c	glibc-2.44@2.44-r6	no fix listed
Low	GO-2026-5544	github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.159.0	no fix listed
Low	GO-2026-6303	golang.org/x/crypto@v0.54.0	0.55.0
Low	CGA-2727-9j94-3x3p	glibc-2.44@2.44-r6	no fix listed
Low	GO-2022-0635	github.com/aws/aws-sdk-go@v1.55.8	no fix listed
Low	CGA-2w63-hvq4-f4pc	glibc-2.44@2.44-r1	2.44-r6
Low	CGA-cvw6-9pj6-fx5j	openssl@3.6.4-r5	no fix listed
Low	CGA-ww43-fhm7-mff3	openssl@3.6.4-r5	no fix listed
Low	GO-2026-5841	github.com/klauspost/compress@v1.18.6	1.18.7
Low	GO-2026-5932	golang.org/x/crypto@v0.56.0	no fix listed
Low	GO-2026-6094	github.com/google/cel-go@v0.29.2	0.30.0
Low	GHSA-8wmf-6v46-5gfg	go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.40.0	1.45.0
Low	GHSA-8wmf-6v46-5gfg	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.40.0	1.45.0
Low	GHSA-8wmf-6v46-5gfg	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.44.0	1.45.0
Low	GHSA-8wmf-6v46-5gfg	go.opentelemetry.io/otel/sdk@v1.44.0	1.45.0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.0.23latest	—	1.0.0	00689	787
0.0.22	—	1.0.0	00897	865
0.0.21	—	1.0.0	00276	484
0.0.19	—	1.0.0	00296	643
0.0.17	—	1.0.0	003108	841

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/quench-lgtm-stack/lgtm-stack.svg)](https://charts.stackradar.io/charts/quench-lgtm-stack/lgtm-stack)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.