commit 10c7f03b3b updated google.golang.org/protobuf
to v1.33.0, which addresses CVE-2024-24786, however a follow-up post on the
Golang security list issued a warning that the v1.33.0 update introduced a
breaking change, causing compatibility with github.com/golang/protobuf to be
broken;
> A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown
> option is set (as well as when unmarshaling into any message which contains a
> google.protobuf.Any). There is no UnmarshalUnknown option.
>
> In addition, version 1.33.0 of google.golang.org/protobuf inadvertently
> introduced an incompatibility with the older github.com/golang/protobuf
> module. (https://github.com/golang/protobuf/issues/1596) Users of the older
> module should update to github.com/golang/protobuf@v1.5.4.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 45e425ccce)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
All components need to use a consistent `semconv` version or OTel
will emit errors about "cannot merge resource due to conflicting Schema URL".
Switch to the appropriate semconv version, which requires dropping
usage of `httpconv`. Instead, the upstream HTTP client hooks are
used directly. (The lower-level functions are no longer exported by
OTel.)
Signed-off-by: Milas Bowman <milas.bowman@docker.com>
(cherry picked from commit ad3b806a4f)
Signed-off-by: Derek McGowan <derek@mcg.dev>
Upgrade to the latest OpenTelemetry libraries; this will unblock
a lot of downstream projects in the ecosystem to upgrade, as some
of the parts here were pre-1.0/unstable.
See also:
* containerd/containerd#9256
Signed-off-by: Milas Bowman <milas.bowman@docker.com>
This "soft" deprecates the package, but keeps the local uses of the package,
which can make backporting this to release-branches easier (we can
still move all uses in those branches as well though).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit d69ae811d6)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit f1591cc9b9)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/sirupsen/logrus/compare/v1.9.0...v1.9.3
v1.9.3
- Fix a potential denial of service vulnerability in logrus.Writer()
that could be triggered by logging text longer than 64kb without newlines
- Fix panic in Writer
v1.9.2
Reverts "Fix a potential denial of service vulnerability in logrus.Writer()",
which introduced a regression.
v1.9.1
- Fix data race in hooks.test package
- Add instructions to use different log levels for local and syslog
- Fix a potential denial of service vulnerability in logrus.Writer()
that could be triggered by logging text longer than 64kb without newlines
- Use text when shows the logrus output
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Pin it with 1e0d26eb2381594984ee80989c9c229dbd930d9f
Signed-off-by: Wei Fu <fuweid89@gmail.com>
(cherry picked from commit 59b0b39af0)
Signed-off-by: Danny Canter <danny@dcantah.dev>
This brings in a ton of great improvements, most notably for the containerd
daemon is performance improvements for cgroups1 and 2 for gathering stats,
as well as some fixes for enabling controllers and deleting v1 cgroups.
Signed-off-by: Danny Canter <danny@dcantah.dev>
Update dependencies and remove the local bindfilter files. Those have
been moved to go-winio.
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
We will use this in future commits to see if the kubelet requested idmap
mounts for volumes, that we don't yet support.
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
Update NRI plugin configuration to match that of NRI. Remove
option for the eliminated NRI configuration file. Add option
to disable connections from externally launched plugins. Add
options to override default plugin registration and request
timeouts.
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
Samuel Karp