dilim/helm
1
0
Fork 0
mirror of https://github.com/helm/helm.git synced 2026-08-09 01:21:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: drop containerd v1 dep to resolve govulncheck CVEs

Browse Source 
containerd v1 is EOL and will never receive fixes for
GO-2026-5622, GO-2026-5338, GO-2026-5064. The only import
was for `remotes.Resolver` in the deprecated `ClientOptResolver`
stub. Changing its parameter type to `any` preserves the public
API while removing the vulnerable dependency entirely.

It should help for PR like https://github.com/helm/helm/pull/32297

Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
(cherry picked from commit a061886b72)
This commit is contained in:
Benoit Tigeot
2026-07-08 12:03:39 +02:00
committed by Matt Farina
parent d3e178ba06
commit 037733e7d5
4 changed files with 2 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
go.mod
View File

@@ -11,7 +11,6 @@ require (
github.com/Masterminds/squirrel v1.5.4
github.com/Masterminds/vcs v1.13.3
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
github.com/containerd/containerd v1.7.33
github.com/cyphar/filepath-securejoin v0.7.0
github.com/distribution/distribution/v3 v3.1.1
github.com/evanphx/json-patch v5.9.11+incompatible
@@ -60,9 +59,6 @@ require (
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/chai2010/gettext-go v1.0.2 // indirect
github.com/containerd/errdefs v0.3.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/platforms v0.2.1 // indirect
github.com/coreos/go-systemd/v22 v22.7.0 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect

8
go.sum
View File

@@ -49,14 +49,6 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
github.com/containerd/containerd v1.7.33 h1:iAkYGC/ifR/V+0eR4iXWHNGYUF0DF2PmGV5iz4Irj5M=
github.com/containerd/containerd v1.7.33/go.mod h1:gSbSCVjPCdkfJCjyrzz7aRC+xFlqVbatNpfHfVCYGUM=
github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=

3
pkg/registry/client.go
View File

@@ -31,7 +31,6 @@ import (
"sync"
"github.com/Masterminds/semver/v3"
"github.com/containerd/containerd/remotes"
"github.com/opencontainers/image-spec/specs-go"
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
"github.com/pkg/errors"
@@ -237,7 +236,7 @@ func ClientOptPlainHTTP() ClientOption {
}
}
func ClientOptResolver(_ remotes.Resolver) ClientOption {
func ClientOptResolver(_ any) ClientOption {
return func(c *Client) {
c.err = errDeprecatedRemote
}

5
pkg/registry/client_test.go
View File

@@ -21,7 +21,6 @@ import (
"io"
"testing"
"github.com/containerd/containerd/remotes"
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@@ -29,9 +28,7 @@ import (
)
func TestNewClientResolverNotSupported(t *testing.T) {
var r remotes.Resolver
client, err := NewClient(ClientOptResolver(r))
client, err := NewClient(ClientOptResolver(nil))
require.Equal(t, err, errDeprecatedRemote)
assert.Nil(t, client)
}