Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump the go_modules group across 1 directory with 10 updates #12

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Mar 13, 2024

Bumps the go_modules group with 4 updates in the / directory: helm.sh/helm/v3, github.com/hashicorp/go-getter, github.com/opencontainers/runc and golang.org/x/image.

Updates helm.sh/helm/v3 from 3.9.4 to 3.14.3

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.14.3 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.14.3. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.4 will contain only bug fixes and be released on April 10, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

Changelog

  • Add a note about --dry-run displaying secrets f03cc04caaa8f6d7c3e67cf918929150cf6f3f12 (Matt Farina)
  • add error messages 1a7330fe3802beeb3f897a1c701d8a4b9c1316c5 (George Jenkins)
  • Fix: Ignore alias validation error for index load d6acc0027dca47dec40ccdd66febd0c8bcf4813f (George Jenkins)
  • chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 b2738fb782d149ffa4748cb0ee78d674986d04b0 (dependabot[bot])
  • chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5b0847e0e763e98bcbf8a12e8f9c5f7c11d123a1 (dependabot[bot])
  • Update architecture detection method 7e18c39f0753c73e4660f3796f01f5b33f2552b5 (weidongkl)

Helm v3.14.2 is a security (patch) release. Users are strongly recommended to update to this release.

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Jakub Ciolek with AlphaSense discovered the vulnerability.

Installation and Upgrading

... (truncated)

Commits
  • f03cc04 Add a note about --dry-run displaying secrets
  • 1a7330f add error messages
  • d6acc00 Fix: Ignore alias validation error for index load
  • b2738fb chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12
  • 5b0847e chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2
  • 7e18c39 Update architecture detection method
  • c309b6f Some fixes
  • e8858f8 validation fix
  • 3fc9f4b Improve release action
  • 69dcc92 bump version to
  • Additional commits viewable in compare view

Updates github.com/containerd/containerd from 1.6.18 to 1.7.12

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.12

Welcome to the v1.7.12 release of containerd!

The twelfth patch release for containerd 1.7 contains various fixes and updates.

Notable Updates

  • Fix on dialer function for Windows (#9501)
  • Improve /etc/group handling when appending groups (#9544)
  • Update shim pidfile permissions to 0644 (#9548)
  • Update runc binary to v1.1.11 (#9596)
  • Allow import and export to reference missing content (#9600)
  • Remove runc import (#9605)
  • Update Go version to 1.20.13 (#9624)

Deprecation Warnings

  • Emit deprecation warning for containerd.io/restart.logpath label usage (#9567)

See the changelog for complete list of changes

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Akihiro Suda
  • Sebastiaan van Stijn
  • Wei Fu
  • Derek McGowan
  • Paweł Gronowski
  • Jaroslav Jindrak
  • Maksym Pavlenko
  • Samuel Karp
  • Anthony Nandaa
  • Bjorn Neergaard
  • Djordje Lukic
  • Kay Yan

Changes

  • [release/1.7] Prepare release notes for v1.7.12 (#9632)
    • 775d544fe Prepare release notes for v1.7.12
  • [release/1.7] update to go1.20.13, test go1.21.6 (#9624)
    • a5dc5b894 update to go1.20.13, test go1.21.6
  • [release/1.7] shim: Create pid-file and address with 0644 permissions (#9548)
    • 8d82242eb shim: Create address file with 0644 permissions
    • 260963a35 shim: Create pid-file with 0644 permissions

... (truncated)

Commits
  • 71909c1 Merge pull request #9632 from dmcgowan/prepare-v1.7.12
  • 775d544 Prepare release notes for v1.7.12
  • 4ebe8e2 Merge pull request #9624 from thaJeztah/1.7_update_golang_1.20.13
  • a5dc5b8 update to go1.20.13, test go1.21.6
  • 50e7359 Merge pull request #9548 from Dzejrou/1.7_fix_ignoring_umask
  • 5a675f2 Merge pull request #9602 from thaJeztah/1.7_backport_no_execabs
  • ccca466 Merge pull request #9605 from thaJeztah/1.7_backport_switch_moby_user
  • 9251072 remove github.com/opencontainers/runc dependency
  • 4e67213 vendor: github.com/cncf-tags/container-device-interface v0.6.1
  • e0ee0be go.mod: github.com/opencontainers/runtime-spec v1.1.0
  • Additional commits viewable in compare view

Updates github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.2.4

This release fixes a potential security issue in filepath-securejoin when used on Windows (GHSA-6xv5-86q9-7xr8, which could be used to generate paths outside of the provided rootfs in certain cases), as well as improving the overall behaviour of filepath-securejoin when dealing with Windows paths that contain volume names. Thanks to Paulo Gomes for discovering and fixing these issues.

In addition, we've switched (at long last) to GitHub Actions and have continuous integration testing on Linux, MacOS, and Windows.

Thanks to the following contributors for making this release possible:

Signed-off-by: Aleksa Sarai [email protected]

Commits

Updates github.com/hashicorp/go-getter from 1.6.2 to 1.7.0

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.7.0

What's Changed

New Contributors

Full Changelog: hashicorp/go-getter@v1.6.2...v1.7.0

Commits
  • 0edab85 Merge pull request #413 from hashicorp/limited-decompressors-helper
  • b38771f decompressors: add LimitedDecompressors helper
  • 78e6721 Merge pull request #412 from hashicorp/mitigate-decompression-bomb
  • cf15d84 Add decompression bomb mitigation options
  • d229395 Merge pull request #408 from hashicorp/remove-codesign
  • b55f8f7 remove codesign entirely from go-getter
  • 611343a Merge pull request #386 from hashicorp/compliance/add-license
  • 7220a3d Merge pull request #379 from hashicorp/migrate-to-gha
  • 2daac52 Update get_gcs_test.go
  • 95c5f2d Update get_s3_test.go
  • Additional commits viewable in compare view

Updates github.com/opencontainers/runc from 1.1.5 to 1.1.12

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc 1.1.12 -- "Now you're thinking with Portals™!"

This is the twelfth patch release in the 1.1.z release branch of runc. It fixes a high-severity container breakout vulnerability involving leaked file descriptors, and users are strongly encouraged to update as soon as possible.

  • Fix CVE-2024-21626, a container breakout attack that took advantage of a file descriptor that was leaked internally within runc (but never leaked to the container process).

    In addition to fixing the leak, several strict hardening measures were added to ensure that future internal leaks could not be used to break out in this manner again.

    Based on our research, while no other container runtime had a similar leak, none had any of the hardening steps we've introduced (and some runtimes would not check for any file descriptors that a calling process may have leaked to them, allowing for container breakouts due to basic user error).

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages or download them from the authoritative upstream sources, especially since these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Aleksa Sarai [email protected]

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.1.12] - 2024-01-31

Now you're thinking with Portals™!

Security

  • Fix CVE-2024-21626, a container breakout attack that took advantage of a file descriptor that was leaked internally within runc (but never leaked to the container process). In addition to fixing the leak, several strict hardening measures were added to ensure that future internal leaks could not be used to break out in this manner again. Based on our research, while no other container runtime had a similar leak, none had any of the hardening steps we've introduced (and some runtimes would not check for any file descriptors that a calling process may have leaked to them, allowing for container breakouts due to basic user error).

[1.1.11] - 2024-01-01

Happy New Year!

Fixed

Changed

  • Support memory.peak and memory.swap.peak in cgroups v2. Add swapOnlyUsage in MemoryStats. This field reports swap-only usage. For cgroupv1, Usage and Failcnt are set by subtracting memory usage from memory+swap usage. For cgroupv2, Usage, Limit, and MaxUsage are set. (#4000, #4010, #4131)
  • build(deps): bump github.com/cyphar/filepath-securejoin. (#4140)

[1.1.10] - 2023-10-31

Śruba, przykręcona we śnie, nie zmieni sytuacji, jaka panuje na jawie.

Added

  • Support for hugetlb.<pagesize>.rsvd limiting and accounting. Fixes the issue of postres failing when hugepage limits are set. (#3859, #4077)

Fixed

  • Fixed permissions of a newly created directories to not depend on the value of umask in tmpcopyup feature implementation. (#3991, #4060)
  • libcontainer: cgroup v1 GetStats now ignores missing kmem.limit_in_bytes (fixes the compatibility with Linux kernel 6.1+). (#4028)

... (truncated)

Commits
  • 51d5e94 VERSION: release 1.1.12
  • 2a4ed3e merge 1.1-GHSA-xr7r-f8xq-vfvv into release-1.1
  • e9665f4 init: don't special-case logrus fds
  • 683ad2f libcontainer: mark all non-stdio fds O_CLOEXEC before spawning init
  • b6633f4 cgroup: plug leaks of /sys/fs/cgroup handle
  • 284ba30 init: close internal fds before execve
  • fbe3eed setns init: do explicit lookup of execve argument early
  • 0994249 init: verify after chdir that cwd is inside the container
  • 506552a Fix File to Close
  • 099ff69 merge #4177 into opencontainers/runc:release-1.1
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.1.0 to 0.17.0

Commits
  • 9d2ee97 ssh: implement strict KEX protocol changes
  • 4e5a261 ssh: close net.Conn on all NewServerConn errors
  • 152cdb1 x509roots/fallback: update bundle
  • fdfe1f8 ssh: defer channel window adjustment
  • b8ffc16 blake2b: drop Go 1.6, Go 1.8 compatibility
  • 7e6fbd8 ssh: wrap errors from client handshake
  • bda2f3f argon2: avoid clobbering BP
  • 325b735 ssh/test: skip TestSSHCLIAuth on Windows
  • 1eadac5 go.mod: update golang.org/x dependencies
  • b2d7c26 ssh: add (*Client).DialContext method
  • Additional commits viewable in compare view

Updates golang.org/x/image from 0.5.0 to 0.10.0

Commits
  • cb227cd tiff: limit work when decoding malicious images
  • a5392f0 bmp: support to decode 8-bit format with up to 256 color palette
  • f9550b0 go.mod: update golang.org/x dependencies
  • 81c166c go.mod: update golang.org/x dependencies
  • ed5dba0 go.mod: update golang.org/x dependencies
  • 08ca817 font: have Glyph return !ok for U+FFFD substitute
  • b6ac75b go.mod: update golang.org/x dependencies
  • 1b74412 font/sfnt: set type for all NameID constants
  • f632f7f tiff, tiff/lzw, vector: use single space in comments
  • See full diff in compare view

Updates golang.org/x/net from 0.7.0 to 0.17.0

Commits
  • b225e7c http2: limit maximum handler goroutines to MaxConcurrentStreams
  • 88194ad go.mod: update golang.org/x dependencies
  • 2b60a61 quic: fix several bugs in flow control accounting
  • 73d82ef quic: handle DATA_BLOCKED frames
  • 5d5a036 quic: handle streams moving from the data queue to the meta queue
  • 350aad2 quic: correctly extend peer's flow control window after MAX_DATA
  • 21814e7 quic: validate connection id transport parameters
  • a600b35 quic: avoid redundant MAX_DATA updates
  • ea63359 http2: check stream body is present on read timeout
  • ddd8598 quic: version negotiation
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.47.0 to 1.58.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.58.3

Security

  • server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

    In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.58.2

Bug Fixes

  • balancer/weighted_round_robin: fix ticker leak on update

    A new ticker is created every time there is an update of addresses or configuration, but was not properly stopped. This change stops the ticker when it is no longer needed.

Release 1.58.1

Bug Fixes

  • grpc: fix a bug that was decrementing active RPC count too early for streaming RPCs; leading to channel moving to IDLE even though it had open streams
  • grpc: fix a bug where transports were not being closed upon channel entering IDLE

Release 1.58.0

API Changes

See #6472 for details about these changes.

  • balancer: add StateListener to NewSubConnOptions for SubConn state updates and deprecate Balancer.UpdateSubConnState (#6481)
    • UpdateSubConnState will be deleted in the future.
  • balancer: add SubConn.Shutdown and deprecate Balancer.RemoveSubConn (#6493)
    • RemoveSubConn will be deleted in the future.
  • resolver: remove deprecated AddressType (#6451)
    • This was previously used as a signal to enable the "grpclb" load balancing policy, and to pass LB addresses to the policy. Instead, balancer/grpclb/state.Set() should be used to add these addresses to the name resolver's output. The built-in "dns" name resolver already does this.
  • resolver: add new field Endpoints to State and deprecate Addresses (#6471)
    • Addresses will be deleted in the future.

New Features

  • balancer/leastrequest: Add experimental support for least request LB policy and least request configured as a custom xDS policy (#6510, #6517)
    • Set GRPC_EXPERIMENTAL_ENABLE_LEAST_REQUEST=true to enable
  • stats: Add an RPC event for blocking caused by the LB policy's picker (#6422)

Bug Fixes

  • clusterresolver: fix deadlock when dns resolver responds inline with update or error at build time (#6563)
  • grpc: fix a bug where the channel could erroneously report TRANSIENT_FAILURE when actually moving to IDLE (#6497)
  • balancergroup: do not cache closed sub-balancers by default; affects rls, weightedtarget and clustermanager LB policies (#6523)
  • client: fix a bug that prevented detection of RPC status in trailers-only RPC responses when using ClientStream.Header(), and prevented retry of the RPC (#6557)

Performance Improvements

  • client & server: Add experimental [With]SharedWriteBuffer to improve performance by reducing allocations when sending RPC messages. (Disabled by default.) (#6309)

... (truncated)

Commits

Updates google.golang.org/protobuf from 1.28.0 to 1.31.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…ates

Bumps the go_modules group with 4 updates in the / directory: [helm.sh/helm/v3](https://github.com/helm/helm), [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter), [github.com/opencontainers/runc](https://github.com/opencontainers/runc) and [golang.org/x/image](https://github.com/golang/image).


Updates `helm.sh/helm/v3` from 3.9.4 to 3.14.3
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v3.9.4...v3.14.3)

Updates `github.com/containerd/containerd` from 1.6.18 to 1.7.12
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v1.6.18...v1.7.12)

Updates `github.com/cyphar/filepath-securejoin` from 0.2.3 to 0.2.4
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Commits](cyphar/filepath-securejoin@v0.2.3...v0.2.4)

Updates `github.com/hashicorp/go-getter` from 1.6.2 to 1.7.0
- [Release notes](https://github.com/hashicorp/go-getter/releases)
- [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml)
- [Commits](hashicorp/go-getter@v1.6.2...v1.7.0)

Updates `github.com/opencontainers/runc` from 1.1.5 to 1.1.12
- [Release notes](https://github.com/opencontainers/runc/releases)
- [Changelog](https://github.com/opencontainers/runc/blob/v1.1.12/CHANGELOG.md)
- [Commits](opencontainers/runc@v1.1.5...v1.1.12)

Updates `golang.org/x/crypto` from 0.1.0 to 0.17.0
- [Commits](golang/crypto@v0.1.0...v0.17.0)

Updates `golang.org/x/image` from 0.5.0 to 0.10.0
- [Commits](golang/image@v0.5.0...v0.10.0)

Updates `golang.org/x/net` from 0.7.0 to 0.17.0
- [Commits](golang/net@v0.7.0...v0.17.0)

Updates `google.golang.org/grpc` from 1.47.0 to 1.58.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.47.0...v1.58.3)

Updates `google.golang.org/protobuf` from 1.28.0 to 1.31.0

---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
  dependency-type: direct:production
  dependency-group: go_modules-security-group
- dependency-name: github.com/containerd/containerd
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: github.com/hashicorp/go-getter
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: github.com/opencontainers/runc
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: golang.org/x/image
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: golang.org/x/net
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: google.golang.org/grpc
  dependency-type: indirect
  dependency-group: go_modules-security-group
- dependency-name: google.golang.org/protobuf
  dependency-type: indirect
  dependency-group: go_modules-security-group
...

Signed-off-by: dependabot[bot] <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants