This includes migrating from cdi.GetRegistry() to cdi.Configure() and
using top-level cdi Refresh and InjectDevices functions as applicable.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
This change excludes the github.com/mitchellh/osext indirect dependency
to resolve compile from source use case issue due to dependency no
longer being available.
Signed-off-by: Austin Vazquez <macedonv@amazon.com>
commit 10c7f03b3b updated google.golang.org/protobuf
to v1.33.0, which addresses CVE-2024-24786, however a follow-up post on the
Golang security list issued a warning that the v1.33.0 update introduced a
breaking change, causing compatibility with github.com/golang/protobuf to be
broken;
> A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown
> option is set (as well as when unmarshaling into any message which contains a
> google.protobuf.Any). There is no UnmarshalUnknown option.
>
> In addition, version 1.33.0 of google.golang.org/protobuf inadvertently
> introduced an incompatibility with the older github.com/golang/protobuf
> module. (https://github.com/golang/protobuf/issues/1596) Users of the older
> module should update to github.com/golang/protobuf@v1.5.4.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 45e425ccce)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
All components need to use a consistent `semconv` version or OTel
will emit errors about "cannot merge resource due to conflicting Schema URL".
Switch to the appropriate semconv version, which requires dropping
usage of `httpconv`. Instead, the upstream HTTP client hooks are
used directly. (The lower-level functions are no longer exported by
OTel.)
Signed-off-by: Milas Bowman <milas.bowman@docker.com>
(cherry picked from commit ad3b806a4f)
Signed-off-by: Derek McGowan <derek@mcg.dev>
Upgrade to the latest OpenTelemetry libraries; this will unblock
a lot of downstream projects in the ecosystem to upgrade, as some
of the parts here were pre-1.0/unstable.
See also:
* containerd/containerd#9256
Signed-off-by: Milas Bowman <milas.bowman@docker.com>
Upgrade gRPC in anticipation of upgrading OTel, which raises the
lower limit.
As gRPC upgrades have been known to cause issues, this is being
done pre-emptively. Additionally, it ensures we avoid v1.58.2,
which has a known CVE, but would otherwise be chosen by MVS from
`go mod`.
Signed-off-by: Milas Bowman <milas.bowman@docker.com>
full diff: https://github.com/golang/text/compare/v0.13.0...v0.17.0
This fixes the same CVE as go1.21.3 and go1.20.10;
- net/http: rapid stream resets can cause excessive work
A malicious HTTP/2 client which rapidly creates requests and
immediately resets them can cause excessive server resource consumption.
While the total number of requests is bounded to the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.
HTTP/2 servers now bound the number of simultaneously executing
handler goroutines to the stream concurrency limit. New requests
arriving when at the limit (which can only happen after the client
has reset an existing, in-flight request) will be queued until a
handler exits. If the request queue grows too large, the server
will terminate the connection.
This issue is also fixed in golang.org/x/net/http2 v0.17.0,
for users manually configuring HTTP/2.
The default stream concurrency limit is 250 streams (requests)
per HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.
This is CVE-2023-39325 and Go issue https://go.dev/issue/63417.
This is also tracked by CVE-2023-44487.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit f7c9e99422)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This "soft" deprecates the package, but keeps the local uses of the package,
which can make backporting this to release-branches easier (we can
still move all uses in those branches as well though).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit d69ae811d6)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit f1591cc9b9)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/sirupsen/logrus/compare/v1.9.0...v1.9.3
v1.9.3
- Fix a potential denial of service vulnerability in logrus.Writer()
that could be triggered by logging text longer than 64kb without newlines
- Fix panic in Writer
v1.9.2
Reverts "Fix a potential denial of service vulnerability in logrus.Writer()",
which introduced a regression.
v1.9.1
- Fix data race in hooks.test package
- Add instructions to use different log levels for local and syslog
- Fix a potential denial of service vulnerability in logrus.Writer()
that could be triggered by logging text longer than 64kb without newlines
- Use text when shows the logrus output
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Pin it with 1e0d26eb2381594984ee80989c9c229dbd930d9f
Signed-off-by: Wei Fu <fuweid89@gmail.com>
(cherry picked from commit 59b0b39af0)
Signed-off-by: Danny Canter <danny@dcantah.dev>
This brings in a ton of great improvements, most notably for the containerd
daemon is performance improvements for cgroups1 and 2 for gathering stats,
as well as some fixes for enabling controllers and deleting v1 cgroups.
Signed-off-by: Danny Canter <danny@dcantah.dev>
Update dependencies and remove the local bindfilter files. Those have
been moved to go-winio.
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
We will use this in future commits to see if the kubelet requested idmap
mounts for volumes, that we don't yet support.
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
Samuel Karp