dilim/containerd
1
0
Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-08-08 17:11:15 +00:00
Code Issues Packages Projects Releases Wiki Activity
17,094 Commits 32 Branches 312 Tags
dependabot/github_actions/codeql-actions-432e0d4de6
Commit Graph

1024 Commits

Author SHA1 Message Date
Tianon Gravi
e01c004cc6 Remove dependency on github.com/opencontainers/runtime-tools 
The direct use was two lines in `internal/cri/nri/nri_api_linux.go` -- constructing a `generate.Generator{Config: spec}` solely to satisfy the `nrigen.UnderlyingGenerator` interface defined in `containerd/nri`. Since that interface already exists, we just need an implementation. Add `spec_generator.go` in the same package, implementing `UnderlyingGenerator` directly on `*rspec.Spec` with no external dependencies beyond `runtime-spec`.

Assisted-By: "claude my eyes right out"
Signed-off-by: Tianon Gravi <tianon.gravi@docker.com>
 2026-08-05 16:58:50 -07:00
Maksym Pavlenko
49854964b2 Merge pull request #13395 from kolyshkin/selinux-1.15.0 
bump selinux to v1.15.1, use SetProcessKind
 2026-08-05 18:09:56 +00:00
Derek McGowan
a272df5685 Update api version to v1.12.0-beta.0 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2026-08-04 19:43:54 -07:00
Maksym Pavlenko
288104923b Merge pull request #13862 from containerd/dependabot/go_modules/github.com/containerd/imgcrypt/v2-2.0.3 
build(deps): bump github.com/containerd/imgcrypt/v2 from 2.0.2 to 2.0.3
 2026-07-29 00:27:03 +00:00
Kir Kolyshkin
ba3a464b8d bump oc/selinux to v1.15.1, use SetProcessKind 
Drop internal/cri/seutil/seutil.go in favor of direct call to newly
introduced selinux.SetProcessKind.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2026-07-28 16:23:54 -07:00
Kir Kolyshkin
4167499888 deps: bump oc/selinux to v1.14.1 
Switch away from deprecated functionality.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2026-07-28 16:23:54 -07:00
Maksym Pavlenko
13db49bef1 Merge pull request #13861 from containerd/dependabot/go_modules/github.com/klauspost/compress-1.19.1 
build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1
 2026-07-28 17:10:07 +00:00
dependabot[bot]
af9ded8e88 build(deps): bump github.com/prometheus/client_golang 
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.23.2 to 1.24.0.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-28 00:13:00 +00:00
dependabot[bot]
fbbe206722 build(deps): bump github.com/containerd/imgcrypt/v2 from 2.0.2 to 2.0.3 
Bumps [github.com/containerd/imgcrypt/v2](https://github.com/containerd/imgcrypt) from 2.0.2 to 2.0.3.
- [Release notes](https://github.com/containerd/imgcrypt/releases)
- [Changelog](https://github.com/containerd/imgcrypt/blob/main/CHANGES)
- [Commits](https://github.com/containerd/imgcrypt/compare/v2.0.2...v2.0.3)

---
updated-dependencies:
- dependency-name: github.com/containerd/imgcrypt/v2
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-28 00:12:46 +00:00
dependabot[bot]
7fdc69ca0c build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.19.0 to 1.19.1.
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](https://github.com/klauspost/compress/compare/v1.19.0...v1.19.1)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-28 00:12:28 +00:00
dependabot[bot]
c8fdb63ea1 build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 23:23:31 +00:00
dependabot[bot]
b1085e19b7 build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 
Bumps [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) from 1.9.0 to 1.10.1.
- [Release notes](https://github.com/fsnotify/fsnotify/releases)
- [Changelog](https://github.com/fsnotify/fsnotify/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fsnotify/fsnotify/compare/v1.9.0...v1.10.1)

---
updated-dependencies:
- dependency-name: github.com/fsnotify/fsnotify
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 20:53:25 +00:00
Mike Brown
857237845d Merge pull request #13453 from liggitt/binary-env-main 
Handle []byte envvar value for CRI
 2026-07-23 17:37:44 +00:00
Maksym Pavlenko
f2e253ffaa Merge pull request #13820 from containerd/dependabot/go_modules/github.com/erofs/go-erofs-0.3.1 
build(deps): bump github.com/erofs/go-erofs from 0.3.0 to 0.3.1
 2026-07-23 16:09:44 +00:00
Jordan Liggitt
78abbfb7f7 update to v0.36.x kubernetes dependencies 
Signed-off-by: Jordan Liggitt <liggitt@google.com>
 2026-07-23 10:39:43 -04:00
Samuel Karp
55e47e129a Merge pull request #13812 from ningmingxiao/bump_nri 
build: bump github.com/containerd/nri
 2026-07-22 05:52:20 +00:00
dependabot[bot]
6e4c6acc0d build(deps): bump github.com/erofs/go-erofs from 0.3.0 to 0.3.1 
Bumps [github.com/erofs/go-erofs](https://github.com/erofs/go-erofs) from 0.3.0 to 0.3.1.
- [Release notes](https://github.com/erofs/go-erofs/releases)
- [Commits](https://github.com/erofs/go-erofs/compare/v0.3.0...v0.3.1)

---
updated-dependencies:
- dependency-name: github.com/erofs/go-erofs
  dependency-version: 0.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-21 03:46:50 +00:00
Samuel Karp
10b42e4ed5 Merge pull request #13806 from containerd/dependabot/go_modules/golang-x-017d72eac4 
build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 in the golang-x group
 2026-07-20 22:11:17 +00:00
ningmingxiao
5d35f9ef97 build: bump github.com/containerd/nri 
Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
 2026-07-20 11:00:24 -05:00
dependabot[bot]
10e0d68a94 build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 
Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) from 2.4.2 to 2.4.3.
- [Release notes](https://github.com/pelletier/go-toml/releases)
- [Commits](https://github.com/pelletier/go-toml/compare/v2.4.2...v2.4.3)

---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-17 23:23:22 +00:00
dependabot[bot]
9ead7c087d build(deps): bump golang.org/x/mod in the golang-x group 
Bumps the golang-x group with 1 update: [golang.org/x/mod](https://github.com/golang/mod).


Updates `golang.org/x/mod` from 0.37.0 to 0.38.0
- [Commits](https://github.com/golang/mod/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-17 23:22:53 +00:00
Maksym Pavlenko
54f83847cb Merge pull request #13768 from containerd/dependabot/go_modules/github.com/klauspost/compress-1.19.0 
build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0
 2026-07-12 21:15:19 +00:00
Maksym Pavlenko
567f197994 Merge pull request #13766 from containerd/dependabot/go_modules/golang-x-c40dbcb055 
build(deps): bump the golang-x group across 1 directory with 2 updates
 2026-07-12 21:15:00 +00:00
dependabot[bot]
d5657dbf64 build(deps): bump the golang-x group across 1 directory with 2 updates 
Bumps the golang-x group with 2 updates in the / directory: [golang.org/x/sync](https://github.com/golang/sync) and [golang.org/x/sys](https://github.com/golang/sys).


Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0)

Updates `golang.org/x/sys` from 0.46.0 to 0.47.0
- [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/sys
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-12 15:18:15 +00:00
dependabot[bot]
bfae6f3513 build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-12 15:18:05 +00:00
dependabot[bot]
61a70e7ef2 build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0.
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 23:23:43 +00:00
Jordan Liggitt
658a1c78b5 build(deps): bump github.com/containerd/ttrpc to v1.2.9 
Signed-off-by: Jordan Liggitt <liggitt@google.com>
 2026-07-08 16:01:04 -04:00
Fu Wei
75b4d06ff9 Merge pull request #13672 from containerd/dependabot/go_modules/github.com/pelletier/go-toml/v2-2.4.2 
build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.1 to 2.4.2
 2026-07-04 20:44:29 +00:00
dependabot[bot]
d763407d4a build(deps): bump github.com/Microsoft/hcsshim 
Bumps [github.com/Microsoft/hcsshim](https://github.com/Microsoft/hcsshim) from 0.15.0-rc.1 to 0.15.0-rc.3.
- [Release notes](https://github.com/Microsoft/hcsshim/releases)
- [Commits](https://github.com/Microsoft/hcsshim/compare/v0.15.0-rc.1...v0.15.0-rc.3)

---
updated-dependencies:
- dependency-name: github.com/Microsoft/hcsshim
  dependency-version: 0.15.0-rc.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-29 23:23:04 +00:00
dependabot[bot]
6079844dae build(deps): bump github.com/moby/sys/user 
Bumps the moby-sys group with 1 update in the / directory: [github.com/moby/sys/user](https://github.com/moby/sys).


Updates `github.com/moby/sys/user` from 0.4.0 to 0.4.1
- [Release notes](https://github.com/moby/sys/releases)
- [Commits](https://github.com/moby/sys/compare/user/v0.4.0...user/v0.4.1)

---
updated-dependencies:
- dependency-name: github.com/moby/sys/user
  dependency-version: 0.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: moby-sys
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-26 16:34:00 +00:00
Sebastiaan van Stijn
35f753cc44 pkg/archive: remove redundant github.com/moby/sys/sequential dependency 
Go 1.26 adds support for passing Windows file flags via os.OpenFile,
eliminating the need to call windows.CreateFile directly.

github.com/moby/sys/sequential v0.7.0 uses this functionality when
compiled with go1.26, but provides fallbacks for older Go versions.

Given that containerd has go1.26 as a minimum requirement, we can
remove github.com/moby/sys/sequential as an intermediate, and implement
the code locally.

ref:

- 9d2fc630f5
- https://go-review.googlesource.com/c/go/+/699415
- https://go-review.googlesource.com/c/go/+/724621

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-26 10:14:53 +02:00
dependabot[bot]
fb80dbbf94 build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.1 to 2.4.2 
Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) from 2.4.1 to 2.4.2.
- [Release notes](https://github.com/pelletier/go-toml/releases)
- [Commits](https://github.com/pelletier/go-toml/compare/v2.4.1...v2.4.2)

---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-25 19:37:24 +00:00
Maksym Pavlenko
9ffb2ed974 Merge pull request #13493 from containerd/dependabot/go_modules/github.com/mdlayher/vsock-1.3.0 
build(deps): bump github.com/mdlayher/vsock from 1.2.1 to 1.3.0
 2026-06-25 15:20:42 +00:00
Maksym Pavlenko
a1030ad4db Merge pull request #13527 from containerd/dependabot/go_modules/github.com/intel/goresctrl-0.13.0 
build(deps): bump github.com/intel/goresctrl from 0.12.0 to 0.13.0
 2026-06-25 15:20:00 +00:00
Maksym Pavlenko
a4e0f8d510 Merge pull request #13557 from containerd/dependabot/go_modules/moby-sys-eb8ba2dd7c 
build(deps): bump github.com/moby/sys/sequential from 0.6.0 to 0.7.0 in the moby-sys group across 1 directory
 2026-06-25 04:46:56 +00:00
dependabot[bot]
3fdb9abcab build(deps): bump github.com/mdlayher/vsock from 1.2.1 to 1.3.0 
Bumps [github.com/mdlayher/vsock](https://github.com/mdlayher/vsock) from 1.2.1 to 1.3.0.
- [Release notes](https://github.com/mdlayher/vsock/releases)
- [Changelog](https://github.com/mdlayher/vsock/blob/main/CHANGELOG.md)
- [Commits](https://github.com/mdlayher/vsock/compare/v1.2.1...v1.3.0)

---
updated-dependencies:
- dependency-name: github.com/mdlayher/vsock
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 21:32:37 -07:00
dependabot[bot]
787bb3da64 build(deps): bump github.com/intel/goresctrl from 0.12.0 to 0.13.0 
Bumps [github.com/intel/goresctrl](https://github.com/intel/goresctrl) from 0.12.0 to 0.13.0.
- [Release notes](https://github.com/intel/goresctrl/releases)
- [Commits](https://github.com/intel/goresctrl/compare/v0.12.0...v0.13.0)

---
updated-dependencies:
- dependency-name: github.com/intel/goresctrl
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 21:31:31 -07:00
dependabot[bot]
7f3f8fffdd build(deps): bump go.etcd.io/bbolt from 1.4.3 to 1.5.0 
Bumps [go.etcd.io/bbolt](https://github.com/etcd-io/bbolt) from 1.4.3 to 1.5.0.
- [Release notes](https://github.com/etcd-io/bbolt/releases)
- [Commits](https://github.com/etcd-io/bbolt/compare/v1.4.3...v1.5.0)

---
updated-dependencies:
- dependency-name: go.etcd.io/bbolt
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-23 10:23:28 -07:00
dependabot[bot]
f407302bab build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.1 
Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) from 2.3.1 to 2.4.1.
- [Release notes](https://github.com/pelletier/go-toml/releases)
- [Commits](https://github.com/pelletier/go-toml/compare/v2.3.1...v2.4.1)

---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-22 23:23:12 +00:00
dependabot[bot]
ef32a6c8ac build(deps): bump github.com/moby/sys/sequential 
Bumps the moby-sys group with 1 update in the / directory: [github.com/moby/sys/sequential](https://github.com/moby/sys).


Updates `github.com/moby/sys/sequential` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/moby/sys/releases)
- [Commits](https://github.com/moby/sys/compare/signal/v0.6.0...signal/v0.7.0)

---
updated-dependencies:
- dependency-name: github.com/moby/sys/sequential
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: moby-sys
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-22 23:23:06 +00:00
Sebastiaan van Stijn
9838a323ed vendor: golang.org/x/crypto v0.53.0 
golang.org/x/crypto v0.52.0 contains various security updates; those
do NOT impact containerd, but may show up as vulnerability in scanners;

    === Symbol Results ===

    No vulnerabilities found.

    === Package Results ===

    No other vulnerabilities found.

    === Module Results ===

    Vulnerability #1: GO-2026-5033
        Invoking pathological inputs can lead to client panic in
        golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5033
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #2: GO-2026-5023
        Invoking VerifiedPublicKeyCallback permissions skip enforcement in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5023
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #3: GO-2026-5021
        Invoking auth bypass via unenforced @revoked status in
        golang.org/x/crypto/ssh/knownhosts
      More info: https://pkg.go.dev/vuln/GO-2026-5021
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #4: GO-2026-5020
        Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5020
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #5: GO-2026-5019
        Invoking bypass of FIDO/U2F security keys physical interaction in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5019
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #6: GO-2026-5018
        Invoking pathological RSA/DSA parameters may cause DoS in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5018
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #7: GO-2026-5017
        Invoking client can cause server deadlock on unexpected responses in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5017
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #8: GO-2026-5016
        Invoking memory leak when rejecting channels can lead to DoS in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5016
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #9: GO-2026-5015
        Invoking server panic during CheckHostKey/Authenticate in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5015
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #10: GO-2026-5014
        Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5014
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #11: GO-2026-5013
        Invoking byte arithmetic causes underflow and panic in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5013
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #12: GO-2026-5006
        Invoking agent constraints dropped when forwarding keys in
        golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5006
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #13: GO-2026-5005
        Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5005
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Your code is affected by 0 vulnerabilities.
    This scan also found 0 vulnerabilities in packages you import and 13
    vulnerabilities in modules you require, but your code doesn't appear to call
    these vulnerabilities.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-15 20:47:07 +02:00
dependabot[bot]
719088fbaa build(deps): bump the golang-x group with 3 updates 
Bumps the golang-x group with 3 updates: [golang.org/x/mod](https://github.com/golang/mod), [golang.org/x/sync](https://github.com/golang/sync) and [golang.org/x/sys](https://github.com/golang/sys).


Updates `golang.org/x/mod` from 0.36.0 to 0.37.0
- [Commits](https://github.com/golang/mod/compare/v0.36.0...v0.37.0)

Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](https://github.com/golang/sync/compare/v0.20.0...v0.21.0)

Updates `golang.org/x/sys` from 0.45.0 to 0.46.0
- [Commits](https://github.com/golang/sys/compare/v0.45.0...v0.46.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/sync
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/sys
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-08 23:23:20 +00:00
dependabot[bot]
de9dcf6aa6 build(deps): bump the otel group across 1 directory with 8 updates 
Bumps the otel group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.68.0` | `0.69.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.68.0` | `0.69.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.44.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.44.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.44.0` |



Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.68.0 to 0.69.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.68.0 to 0.69.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0)

Updates `go.opentelemetry.io/otel` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/trace` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-version: 0.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: otel
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: otel
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: otel
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-28 07:05:14 +00:00
Maksym Pavlenko
e9404bdc30 Merge pull request #13490 from liggitt/typeurl-dep 
Update typeurl/v2 to v2.3.0 to drop gogo dependency
 2026-05-28 06:25:10 +00:00
dependabot[bot]
8f3c916a76 build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.0 to 1.81.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.0...v1.81.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.81.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-28 00:30:26 +00:00
Jordan Liggitt
ce39143249 Update typeurl/v2 to v2.3.0 to drop gogo dependency 
Signed-off-by: Jordan Liggitt <liggitt@google.com>
 2026-05-27 17:32:08 -04:00
Maksym Pavlenko
a3a47d1370 Merge pull request #13427 from containerd/dependabot/go_modules/k8s-7565455e06 
build(deps): bump the k8s group across 1 directory with 6 updates
 2026-05-26 23:20:22 +00:00
dependabot[bot]
f19f84cfe0 build(deps): bump the k8s group across 1 directory with 6 updates 
Bumps the k8s group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.0` | `0.36.1` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.0` | `0.36.1` |
| [k8s.io/cri-api](https://github.com/kubernetes/cri-api) | `0.36.0` | `0.36.1` |
| [k8s.io/cri-client](https://github.com/kubernetes/cri-client) | `0.36.0` | `0.36.1` |
| [k8s.io/cri-streaming](https://github.com/kubernetes/cri-streaming) | `0.36.0` | `0.36.1` |



Updates `k8s.io/apimachinery` from 0.36.0 to 0.36.1
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.0...v0.36.1)

Updates `k8s.io/client-go` from 0.36.0 to 0.36.1
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](https://github.com/kubernetes/client-go/compare/v0.36.0...v0.36.1)

Updates `k8s.io/cri-api` from 0.36.0 to 0.36.1
- [Commits](https://github.com/kubernetes/cri-api/compare/v0.36.0...v0.36.1)

Updates `k8s.io/cri-client` from 0.36.0 to 0.36.1
- [Commits](https://github.com/kubernetes/cri-client/compare/v0.36.0...v0.36.1)

Updates `k8s.io/cri-streaming` from 0.36.0 to 0.36.1
- [Commits](https://github.com/kubernetes/cri-streaming/compare/v0.36.0...v0.36.1)

Updates `k8s.io/streaming` from 0.36.0 to 0.36.1
- [Commits](https://github.com/kubernetes/streaming/compare/v0.36.0...v0.36.1)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
- dependency-name: k8s.io/cri-api
  dependency-version: 0.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
- dependency-name: k8s.io/cri-client
  dependency-version: 0.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
- dependency-name: k8s.io/cri-streaming
  dependency-version: 0.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
- dependency-name: k8s.io/streaming
  dependency-version: 0.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-26 04:48:19 +00:00
dependabot[bot]
be9c7a8571 build(deps): bump golang.org/x/sys in the golang-x group 
Bumps the golang-x group with 1 update: [golang.org/x/sys](https://github.com/golang/sys).


Updates `golang.org/x/sys` from 0.44.0 to 0.45.0
- [Commits](https://github.com/golang/sys/compare/v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-26 04:47:47 +00:00
Samuel Karp
ae843af785 Merge pull request #13360 from mxpv/task 
Fix sandbox task API endpoints for non-runc runtimes
 2026-05-19 00:15:24 +00:00