`govulncheck -mode=binary` detected the following vulns, but `-mode=source` says "your code doesn't appear to call these vulnerabilities."
```
=== Symbol Results ===
Vulnerability #1: GO-2025-3503
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
More info: https://pkg.go.dev/vuln/GO-2025-3503
Module: golang.org/x/net
Found in: golang.org/x/net@v0.33.0
Fixed in: golang.org/x/net@v0.36.0
Vulnerable symbols found:
#1: httpproxy.config.useProxy
#2: httpproxy.domainMatch.match
#3: proxy.Dial
#4: proxy.FromEnvironment
#5: proxy.FromEnvironmentUsing
Use '-show traces' to see the other 3 found symbols
Vulnerability #2: GO-2025-3488
Unexpected memory consumption during token parsing in golang.org/x/oauth2
More info: https://pkg.go.dev/vuln/GO-2025-3488
Module: golang.org/x/oauth2
Found in: golang.org/x/oauth2@v0.11.0
Fixed in: golang.org/x/oauth2@v0.27.0
Vulnerable symbols found:
#1: jws.Verify
Vulnerability #3: GO-2025-3487
Potential denial of service in golang.org/x/crypto
More info: https://pkg.go.dev/vuln/GO-2025-3487
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.31.0
Fixed in: golang.org/x/crypto@v0.35.0
Vulnerable symbols found:
#1: ssh.Client.Dial
#2: ssh.Client.DialContext
#3: ssh.Client.DialTCP
#4: ssh.Client.Listen
#5: ssh.Client.ListenTCP
Use '-show traces' to see the other 48 found symbols
Your code is affected by 3 vulnerabilities from 3 modules.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.
```
NOTE: Go version requirement is now bumped up from 1.21 to 1.23
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This is the lowest goresctrl version that removed
hashicorp/go-multierror dependency.
This is to fully remove hashicorp/go-multierror dependency.
But this also introduces a few minor version upgrades
of other dependencies.
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
ListPids may not pick up the sh subprocess yet when it is first run. To
make this test more resilient, retry fetching the processes if only a
single pid is found for a short time.
Signed-off-by: Derek McGowan <derek@mcg.dev>
(cherry picked from commit bddeba8250)
Signed-off-by: Derek McGowan <derek@mcg.dev>
This issue was caused by a race between init exits and new exec process
tracking inside the shim. The test operates by controlling the time
between when the shim invokes "runc exec" and when the actual "runc
exec" is triggered. This allows validating that races for shim state
tracking between pre- and post-start of the exec process do not exist.
Relates to https://github.com/containerd/containerd/issues/10589
Signed-off-by: Samuel Karp <samuelkarp@google.com>
(cherry picked from commit 18725f010b)
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Commit 3b263d082c updated the version
of Go used to build containerd to go1.22, but also updated the
version in go.mod.
As there's currently not a requirement for go1.22, we can keep
this at the minimum required version, and revert it to go1.21.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- switch release and build jobs to 1.22.6 from 1.21.13
- add go1.23.0 to CI matrix
- drop go1.21 from CI
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
Commit 8437c567d8 migrated the use of the
userns package to the github.com/moby/sys/user module.
After further discussion with maintainers, it was decided to move the
userns package to a separate module, as it has no direct relation with
"user" operations (other than having "user" in its name).
This patch migrates our code to use the new module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 9776047243)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This updates the platforms package to be an alias for the new platforms module.
This helps transitioning consumers to the new module, and makes sure that
containerd v2 and v1 use the same definitions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Avoid running tests when a plugin fails to load and return the init
error from the plugin. This prevents the test failing later with an
unhelpful error and attempting to find the actual error in the daemon
logs.
Signed-off-by: Derek McGowan <derek@mcg.dev>
(cherry picked from commit b1a23c495a)
Signed-off-by: Derek McGowan <derek@mcg.dev>
The reference/docker package was a fork of github.com/distribution/distribution,
which could not easily be used as a direct dependency, as it brought many other
dependencies with it.
The "reference' package has now moved to a separate repository, which means
we can replace the local fork, and use the upstream implementation again.
The new module was extracted from the distribution repository at commit:
b9b19409cf
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 4923470902)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Import the log module directly, instead of using the aliases that are
provided in the log package. This helps find code-paths that still depend
on the old location, and that haven't migrated yet to the new module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This updates the errdefs package to be an alias for the new errdefs module.
This helps transitioning consumers to the new module, and makes sure that
containerd v2 and v1 use the same definitions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
