Commit graph

447 commits

Author SHA1 Message Date
Paweł Gronowski
e7c60a30e6
vendor: github.com/moby/buildkit v0.13.1
full diff: https://github.com/moby/buildkit/compare/v0.13.0...v0.13.1

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-03-18 20:16:09 +01:00
Sebastiaan van Stijn
1ca89d7eae
vendor: google.golang.org/protobuf v1.33.0, github.com/golang/protobuf v1.5.4
full diffs:

- https://github.com/protocolbuffers/protobuf-go/compare/v1.31.0...v1.33.0
- https://github.com/golang/protobuf/compare/v1.5.3...v1.5.4

From the Go security announcement list;

> Version v1.33.0 of the google.golang.org/protobuf module fixes a bug in
> the google.golang.org/protobuf/encoding/protojson package which could cause
> the Unmarshal function to enter an infinite loop when handling some invalid
> inputs.
>
> This condition could only occur when unmarshaling into a message which contains
> a google.protobuf.Any value, or when the UnmarshalOptions.UnmarshalUnknown
> option is set. Unmarshal now correctly returns an error when handling these
> inputs.
>
> This is CVE-2024-24786.

In a follow-up post;

> A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown
> option is set (as well as when unmarshaling into any message which contains a
> google.protobuf.Any). There is no UnmarshalUnknown option.
>
> In addition, version 1.33.0 of google.golang.org/protobuf inadvertently
> introduced an incompatibility with the older github.com/golang/protobuf
> module. (https://github.com/golang/protobuf/issues/1596) Users of the older
> module should update to github.com/golang/protobuf@v1.5.4.

govulncheck results in our code:

    govulncheck ./...
    Scanning your code and 1221 packages across 204 dependent modules for known vulnerabilities...

    === Symbol Results ===

    Vulnerability #1: GO-2024-2611
        Infinite loop in JSON unmarshaling in google.golang.org/protobuf
      More info: https://pkg.go.dev/vuln/GO-2024-2611
      Module: google.golang.org/protobuf
        Found in: google.golang.org/protobuf@v1.31.0
        Fixed in: google.golang.org/protobuf@v1.33.0
        Example traces found:
          #1: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Peek
          #2: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Read
          #3: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls protojson.Unmarshal

    Your code is affected by 1 vulnerability from 1 module.
    This scan found no other vulnerabilities in packages you import or modules you
    require.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-03-14 13:12:54 +01:00
Sebastiaan van Stijn
ec19fd6fed
vendor: github.com/containerd/containerd v1.7.14
- full diff: https://github.com/containerd/containerd/compare/v1.7.13...v1.7.14
- release notes: https://github.com/containerd/containerd/releases/tag/v1.7.14

Welcome to the v1.7.14 release of containerd!

The fourteenth patch release for containerd 1.7 contains various fixes and updates.

Highlights

- Update builds to use go 1.21.8
- Fix various timing issues with docker pusher
- Register imagePullThroughput and count with MiB
- Move high volume event logs to Trace level

Container Runtime Interface (CRI)

- Handle pod transition states gracefully while listing pod stats

Runtime

- Update runc-shim to process exec exits before init

Dependency Changes

- github.com/containerd/nri v0.4.0 -> v0.6.0
- github.com/containerd/ttrpc v1.2.2 -> v1.2.3
- google.golang.org/genproto/googleapis/rpc 782d3b101e98 -> cbb8c96f2d6d

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-03-12 12:46:19 +01:00
Sebastiaan van Stijn
d19f6d4b6d
vendor: github.com/containerd/ttrpc v1.2.3
full diff: https://github.com/containerd/ttrpc/compare/v1.2.2..v1.2.3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-03-12 12:37:44 +01:00
Paweł Gronowski
0f30791a0d
vendor: github.com/moby/buildkit v0.13.0
full diff: https://github.com/moby/buildkit/compare/v0.13.0-rc3...v0.13.0

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-03-06 11:54:43 +01:00
Akihiro Suda
72ec187dfe
go.mod: github.com/rootless-containers/rootlesskit/v2 v2.0.2
https://github.com/rootless-containers/rootlesskit/compare/v2.0.1...v2.0.2

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2024-03-06 07:38:00 +09:00
Akihiro Suda
83cda67f73
go.mod: golang.org/x/sys v0.18.0
https://github.com/golang/sys/compare/v0.16.0...v0.18.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2024-03-06 07:37:37 +09:00
Paweł Gronowski
9f4e824a6e
vendor: github.com/miekg/dns v1.1.57
full diff: https://github.com/github.com/miekg/dns/compare/v1.1.43...v1.1.57

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-03-01 10:14:22 +01:00
Paweł Gronowski
2c9c5e1c03
vendor: github.com/moby/buildkit v0.13.0-rc3
full diff: https://github.com/moby/buildkit/compare/v0.13.0-rc2...v0.13.0-rc3

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-02-28 10:05:02 +01:00
Sebastiaan van Stijn
9be820d8ca
vendor: go.etcd.io/bbolt v1.3.9
full diff: https://github.com/etcd-io/bbolt/compare/v1.3.7...v1.3.9

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-02-27 18:24:01 +01:00
Paweł Gronowski
31545c3b67
vendor: github.com/moby/buildkit v0.13.0-rc2
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-02-27 11:26:07 +01:00
CrazyMax
f90b03ee5d
go.mod: bump to go 1.21 and use local toolchain when vendoring
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-02-27 11:25:20 +01:00
Sebastiaan van Stijn
c516804d6f
vendor: OTEL v0.46.1 / v1.21.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-02-23 10:11:07 +01:00
Paweł Gronowski
b2aaf5c2b0
vendor: github.com/containerd/continuity v0.4.3
full diff: https://github.com/containerd/continuity/compare/v0.4.3...v0.4.2

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-02-22 10:24:52 +01:00
Paweł Gronowski
70a4a9c969
vendor: bump github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs to v1.32.0
v1.33.0 is also available, but it would also cause
`github.com/aws/aws-sdk-go-v2` change from v1.24.1 to v1.25.0

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-02-14 17:23:55 +01:00
Paweł Gronowski
999f90ac1c
vendor: bump github.com/aws/aws-sdk-go-v2 to v1.24.1
In preparation for buildkit v0.13

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-02-12 18:22:32 +01:00
Sebastiaan van Stijn
ef7766304c
vendor: github.com/containerd/nydus-snapshotter v0.13.7
Update to the latest patch release, which contains changes from v0.13.5 to
remove the reference package from "github.com/docker/distribution", which
is now a separate module.

full diff: https://github.com/containerd/nydus-snapshotter/compare/v0.8.2...v0.13.7

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-02-12 09:25:28 +01:00
Sebastiaan van Stijn
6932939326
vendor: google.golang.org/genproto/googleapis/rpc 49dd2c1f3d0b
manually aligned the indirect dependencies to be on the same commit

diff: b8732ec382...49dd2c1f3d

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-02-12 09:25:26 +01:00
Sebastiaan van Stijn
10a72f2504
vendor: cloud.google.com/go/logging v1.8.1
full diff: https://github.com/googleapis/google-cloud-go/compare/logging/v1.7.0...logging/v1.8.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-02-12 09:24:51 +01:00
Sebastiaan van Stijn
a60fef0c41
vendor: golang.org/x/exp v0.0.0-20231006140011-7918f672742d
full diff: c95f2b4c22...7918f67274

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-02-12 09:13:32 +01:00
Sebastiaan van Stijn
03a17a2887
migrate image spec to github.com/moby/docker-image-spec
The specification was migrated to a separate module:
https://github.com/moby/docker-image-spec

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-02-09 19:12:18 +01:00
Paweł Gronowski
4ab11a1148
vendor: github.com/containerd/containerd v1.7.13
No major changes, it just adds `content.InfoReaderProvider` interface.

full diff: https://github.com/containerd/containerd/compare/v1.7.12...v1.7.13

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-02-08 15:04:04 +01:00
Sebastiaan van Stijn
475019d70a
vendor: github.com/prometheus/procfs v0.12.0
- https://github.com/prometheus/procfs/compare/v0.11.1...v0.12.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-02-07 02:40:09 +01:00
Sebastiaan van Stijn
63c354aae2
vendor: github.com/prometheus/client_golang v1.17.0
full diffs:

- https://github.com/prometheus/client_golang/compare/v1.14.0...v1.17.0
- https://github.com/prometheus/client_model/compare/v0.3.0...v0.5.0
- https://github.com/prometheus/common/compare/v0.42.0...v0.44.0
- https://github.com/prometheus/procfs/compare/v0.9.0...v0.11.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-02-07 02:40:07 +01:00
Akihiro Suda
f1730a6512
go.mod: github.com/rootless-containers/rootlesskit/v2 v2.0.1
https://github.com/rootless-containers/rootlesskit/releases/tag/v2.0.1

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2024-02-06 11:51:00 +09:00
Akihiro Suda
f7192bb0b4
vendor.mod: github.com/google/uuid v1.6.0
https://github.com/google/uuid/releases/tag/v1.6.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2024-02-06 11:50:00 +09:00
Sebastiaan van Stijn
810ef4d0b6
Merge pull request #47244 from thaJeztah/bump_grpc
vendor: google.golang.org/grpc v1.59.0
2024-02-01 15:44:15 +01:00
Sebastiaan van Stijn
584e60e820
Merge pull request #47273 from vvoland/vendor-bk-0.12.5
vendor: github.com/moby/buildkit v0.12.5
2024-01-31 22:24:49 +01:00
Paweł Gronowski
f4a93b6993
vendor: github.com/moby/buildkit v0.12.5
full diff: https://github.com/moby/buildkit/compare/v0.12.4...v0.12.5

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2024-01-31 21:24:50 +01:00
Sebastiaan van Stijn
b20dccba5e
vendor: github.com/opencontainers/runc v1.1.12
- release notes: https://github.com/opencontainers/runc/releases/tag/v1.1.12
- full diff: https://github.com/opencontainers/runc/compare/v1.1.11...v1.1.12

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-31 21:17:56 +01:00
Sebastiaan van Stijn
ca40ac030c
vendor: google.golang.org/grpc v1.59.0
full diff:

- https://github.com/grpc/grpc-go/compare/v1.58.3...v1.59.0
- 782d3b101e...b8732ec382
- https://github.com/googleapis/google-cloud-go/compare/v0.110.4...v0.110.7
- https://github.com/googleapis/google-cloud-go/compare/compute/v1.21.0...compute/v1.23.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-29 18:59:21 +01:00
Sebastiaan van Stijn
0818a476e5
vendor: github.com/go-logr/logr v1.3.0
full diff: https:// github.com/go-logr/logr/compare/v1.2.4...v1.3.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-29 18:51:54 +01:00
Sebastiaan van Stijn
a0b53f6fd2
vendor: golang.org/x/net v0.18.0
full diff: https://github.com/golang/net/compare/v0.17.0...v0.18.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-29 18:49:40 +01:00
Martin Braun
5c2eda6f71 vendor swarmkit v2.0.0-20240125134710-dcda100a8261
Signed-off-by: Martin Braun <braun@neuroforge.de>
2024-01-25 16:26:04 +01:00
Sebastiaan van Stijn
a404017a86
vendor: golang.org/x/tools v0.14.0
full diff: https://github.com/golang/tools/comopare/v0.13.0...v0.14.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-20 22:58:31 +01:00
Sebastiaan van Stijn
41a2aa2ee2
vendor: golang.org/x/oauth2 v0.11.0
full diff: https://github.com/golang/oauth2/comopare/v0.10.0...v0.11.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-20 22:58:31 +01:00
Sebastiaan van Stijn
2799417da1
vendor: golang.org/x/mod v0.13.0, golang.org/x/tools v0.13.0
full diff:

- https://github.com/golang/mod/comopare/v0.11.0...v0.13.0
- https://github.com/golang/tools/comopare/v0.10.0...v0.13.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-20 22:58:30 +01:00
Sebastiaan van Stijn
407ad89ff0
vendor: golang.org/x/sync v0.5.0
full diff: https://github.com/golang/sync/comopare/v0.3.0...v0.5.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-20 22:58:30 +01:00
Akihiro Suda
ba86626642
vendor.mod: github.com/rootless-containers/rootlesskit/v2 v2.0.0
https://github.com/rootless-containers/rootlesskit/releases/tag/v2.0.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2024-01-16 10:56:27 +09:00
Sebastiaan van Stijn
3eba4216e0
Merge pull request #47080 from thaJeztah/bump_mountinfo
vendor: github.com/moby/sys/mountinfo v0.7.1
2024-01-15 13:11:50 +01:00
Sebastiaan van Stijn
c4d2968183
vendor: github.com/moby/sys/mountinfo v0.7.1
full diff: https://github.com/moby/sys/compare/mountinfo/v0.6.2...mountinfo/v0.7.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-15 12:09:02 +01:00
Sebastiaan van Stijn
075e1141b8
vendor: golang.org/x/sys v0.16.0
full diff: https://github.com/golang/sys/compare/v0.15.0...v0.16.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-15 12:05:29 +01:00
Sebastiaan van Stijn
a759acd958
vendor: github.com/google/uuid v1.5.0
full diff: https://github.com/google/uuid/compare/v1.3.1...v1.5.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-15 10:40:15 +01:00
Sebastiaan van Stijn
3bcb01a84f
vendor: github.com/google/go-cmp v0.6.0
full diff: https://github.com/google/go-cmp/compare/v0.5.9...v0.6.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-15 10:40:13 +01:00
Sebastiaan van Stijn
92175dd78c
vendor: containerd v1.7.12, and switch to dario.cat/mergo v1.0.0
Switch github.com/imdario/mergo to dario.cat/mergo v1.0.0, because
the module was renamed, and reached v1.0.0

full diff: https://github.com/imdario/mergo/compare/v0.3.13...v1.0.0

vendor: github.com/containerd/containerd v1.7.12

- full diff: https://github.com/containerd/containerd/compare/v1.7.11...v1.7.12
- release notes: https://github.com/containerd/containerd/releases/tag/v1.7.12

Welcome to the v1.7.12 release of containerd!

The twelfth patch release for containerd 1.7 contains various fixes and updates.

Notable Updates

- Fix on dialer function for Windows
- Improve `/etc/group` handling when appending groups
- Update shim pidfile permissions to 0644
- Update runc binary to v1.1.11
- Allow import and export to reference missing content
- Remove runc import
- Update Go version to 1.20.13

Deprecation Warnings

- Emit deprecation warning for `containerd.io/restart.logpath` label usage

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-12 18:09:24 +01:00
Sebastiaan van Stijn
22b08a10ff
Merge pull request #47032 from thaJeztah/otel_align_versions
vendor: otelhttptrace v0.45.0 to align with other OTEL packages
2024-01-08 17:07:16 +01:00
Sebastiaan van Stijn
97d91aff7b
Merge pull request #47027 from thaJeztah/bump_cgroups
vendor: github.com/containerd/cgroups/v3 v3.0.3
2024-01-08 13:09:33 +01:00
Sebastiaan van Stijn
1dd415df1a
vendor: github.com/vbatts/tar-split v0.11.5
full diff: https://github.com/vbatts/tar-split/compare/v0.11.3...v0.11.5

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-08 11:40:15 +01:00
Sebastiaan van Stijn
372cd16b88
vendor: otelhttptrace v0.45.0 to align with other OTEL packages
This package / module is used by BuildKit's detect package; the buildkit
version we use (v0.12.x) [is using OTEL v0.40.0][1], whereas Moby and Containerd
moved to v0.45.0.

Go module [minimum-version-selection (MVS)][1] will pick the minimum required
version, and because there's no "reverse" dependency from the "main" OTEL modules
to this module, it selects the lowest version (specified in the BuildKit module).

Usually this would be a _good_ thing, but we know that OTEL likes all versions
to be aligned, so let's make it so.

full diff: https://github.com/open-telemetry/opentelemetry-go-contrib/compare/instrumentation/net/http/httptrace/otelhttptrace/v0.40.0...instrumentation/net/http/httptrace/otelhttptrace/v0.45.0

[1]: https://github.com/moby/buildkit/blob/v0.12.4-2-g3b6880d2a/go.mod#L73-L83
[2]: https://go.dev/ref/mod#glos-minimal-version-selection

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-06 11:04:13 +01:00
Sebastiaan van Stijn
22597efa06
vendor: github.com/docker/go-connections v0.5.0
no diff, as the tag is the same commit as we used already;
https://github.com/docker/go-connections/compare/fa09c952e3ea...v0.5.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-01-05 18:20:12 +01:00