Skip to content

build(deps): Bump the go_modules group with 8 updates#658

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go_modules-6389f97bc2
Closed

build(deps): Bump the go_modules group with 8 updates#658
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go_modules-6389f97bc2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Feb 1, 2025 •
edited
Loading

Bumps the go_modules group with 8 updates:

Package From To
github.com/containers/image/v5 5.24.2 5.29.3
github.com/moby/buildkit 0.11.4 0.12.5
github.com/anchore/stereoscope 0.0.0-20230925132944-bf05af58eb44 0.0.1
github.com/cloudflare/circl 1.3.3 1.3.7
github.com/containerd/containerd 1.7.0 1.7.11
github.com/docker/docker 24.0.6+incompatible 24.0.7+incompatible
github.com/go-git/go-git/v5 5.11.0 5.13.0
github.com/sigstore/rekor 1.0.1 1.2.2

Updates github.com/containers/image/v5 from 5.24.2 to 5.29.3

Release notes

Sourced from github.com/containers/image/v5's releases.

v5.29.3

What's Changed

Full Changelog: containers/image@v5.29.2...v5.29.3

v5.29.2

What's Changed

Full Changelog: containers/image@v5.29.1...v5.29.2

v5.29.1

  • Add support for pushing an image with unknown digest

v5.29.0

What's Changed

... (truncated)

Commits
  • 3e684b1 [release-5.29] Bump to v5.29.3
  • e894804 Merge pull request #2418 from mtrmac/digest-unmarshal-5.29
  • 6e25805 Validate the tags returned by a registry
  • 086c760 Call .Validate() before digest.Digest.String() if necessary
  • 0860c58 Refactor the error handling further
  • 7b58b43 Refactor the error handling path of saveStream
  • af94ba1 Call .Validate() before digest.Hex() / digest.Encoded()
  • 9c49ca1 Validate digests before using them
  • 534068f Merge pull request #2270 from TomSweeneyRedHat/dev/tsweeney/ddaemon
  • 0111e79 [release-5.29] Bump to v5.29.3-dev
  • Additional commits viewable in compare view

Updates github.com/moby/buildkit from 0.11.4 to 0.12.5

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.12.5

https://hub.docker.com/r/moby/buildkit

Notable changes:

This release contains following security fixes:

v0.12.4

Welcome to the 0.12.4 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Notable changes

  • Fix possible concurrent map access on remote cache export #4346
  • Fix hang on debug server listener #4361
  • Fix possible deadlock in History API under high number of parallel builds #4362
  • Fix possible panic on handling deleted records in History API #4451
  • Fix possible data corruption in zstd library #4372

v0.12.3

Welcome to the 0.12.3 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Notable changes

  • Fix possible duplicate source files in provenance attestation for chained builds #4190
  • Fix possible negative step time in progressbar for step shared with other build request #4183
  • Fix properly closing history and cache DB on shutdown to avoid corruption #4185 #4189
  • Fix incorrect error handling for invalid HTTP source URLs #4201
  • Fix fallback cases for ambiguous insecure configuration provided for registry used as push target. #4299
  • Fix possible data race with parallel image config resolves #4157
  • Fix regression in v0.12 for clients waiting on buildkitd to become available #4200
  • Fix Cgroup NS handling for hosts supporting only CgroupV1 #4308

v0.12.2

Welcome to the 0.12.2 release of buildkit!

... (truncated)

Commits
  • bac3f2b update runc to v1.1.12
  • f781267 exec: add extra validation for submount sources
  • d089e0b oci: fix error handling on submount calls
  • 00fe637 executor: recheck mount stub path within root after container run
  • 92cc595 llbsolver: make sure interactive container API validates entitlements
  • 5026d95 gateway: pass executor with build and not access worker directly
  • 7718bd5 pb: add extra validation to protobuf types
  • e1924dc sourcepolicy: add validations for nil values
  • 96663dd exporter: add validation for platforms key value
  • 481d9c4 exporter: add validation for invalid platorm
  • Additional commits viewable in compare view

Updates github.com/anchore/stereoscope from 0.0.0-20230925132944-bf05af58eb44 to 0.0.1

Release notes

Sourced from github.com/anchore/stereoscope's releases.

v0.0.1

Security Fixes

Full Changelog: https://github.com/anchore/stereoscope/commits/v0.0.1

Commits

Updates github.com/cloudflare/circl from 1.3.3 to 1.3.7

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.3.7

What's Changed

New Contributors

Full Changelog: cloudflare/circl@v1.3.6...v1.3.7

CIRCL v1.3.6

What's Changed

New Contributors

Full Changelog: cloudflare/circl@v1.3.3...v1.3.6

Commits
  • c48866b Releasing CIRCL v1.3.7
  • 75ef91e kyber: remove division by q in ciphertext compression
  • 899732a build(deps): bump golang.org/x/crypto
  • 99f0f71 Releasing CIRCL v1.3.6
  • e728d0d Apply thibmeu code review suggestions
  • ceb2d90 Updating blindrsa to be compliant with RFC9474.
  • 44133f7 spelling: tripped
  • c2076d6 spelling: transposes
  • dad2166 spelling: title
  • 171c418 spelling: threshold
  • Additional commits viewable in compare view

Updates github.com/containerd/containerd from 1.7.0 to 1.7.11

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.11

Welcome to the v1.7.11 release of containerd!

The eleventh patch release for containerd 1.7 contains various fixes and updates including one security issue.

Notable Updates

  • Fix Windows default path overwrite issue (#9440)
  • Update push to always inherit distribution sources from parent (#9452)
  • Update shim to use net dial for gRPC shim sockets (#9458)
  • Fix otel version incompatibility (#9483)
  • Fix Windows snapshotter blocking snapshot GC on remove failure (#9482)
  • Mask /sys/devices/virtual/powercap path in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c)

Deprecation Warnings

  • Emit deprecation warning for AUFS snapshotter (#9436)
  • Emit deprecation warning for v1 runtime (#9450)
  • Emit deprecation warning for deprecated CRI configs (#9469)
  • Emit deprecation warning for CRI v1alpha1 usage (#9479)
  • Emit deprecation warning for CRIU config in CRI (#9481)

See the changelog for complete list of changes

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Samuel Karp
  • Derek McGowan
  • Phil Estes
  • Bjorn Neergaard
  • Danny Canter
  • Sebastiaan van Stijn
  • ruiwen-zhao
  • Akihiro Suda
  • Amit Barve
  • Charity Kathure
  • Maksym Pavlenko
  • Milas Bowman
  • Paweł Gronowski
  • Wei Fu

Changes

  • [release/1.7] Prepare release notes for v1.7.11 (#9491)

... (truncated)

Changelog

Sourced from github.com/containerd/containerd's changelog.

Versioning and Release

This document details the versioning and release plan for containerd. Stability is a top goal for this project, and we hope that this document and the processes it entails will help to achieve that. It covers the release process, versioning numbering, backporting, API stability and support horizons.

If you rely on containerd, it would be good to spend time understanding the areas of the API that are and are not supported and how they impact your project in the future.

This document will be considered a living document. Supported timelines, backport targets and API stability guarantees will be updated here as they change.

If there is something that you require or this document leaves out, please reach out by filing an issue.

Releases

Releases of containerd will be versioned using dotted triples, similar to Semantic Version. For the purposes of this document, we will refer to the respective components of this triple as <major>.<minor>.<patch>. The version number may have additional information, such as alpha, beta and release candidate qualifications. Such releases will be considered "pre-releases".

Major and Minor Releases

Major and minor releases of containerd will be made from main. Releases of containerd will be marked with GPG signed tags and announced at https://github.com/containerd/containerd/releases. The tag will be of the format v<major>.<minor>.<patch> and should be made with the command git tag -s v<major>.<minor>.<patch>.

After a minor release, a branch will be created, with the format release/<major>.<minor> from the minor tag. All further patch releases will be done from that branch. For example, once we release v1.0.0, a branch release/1.0 will be created from that tag. All future patch releases will be done against that branch.

Pre-releases

Pre-releases, such as alphas, betas and release candidates will be conducted from their source branch. For major and minor releases, these releases will be done from main. For patch releases, these pre-releases should be done within the corresponding release branch.

While pre-releases are done to assist in the stabilization process, no guarantees are provided.

... (truncated)

Commits

Updates github.com/docker/docker from 24.0.6+incompatible to 24.0.7+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v24.0.7

24.0.7

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • Write overlay2 layer metadata atomically. moby/moby#46703
  • Fix "Rootful-in-Rootless" Docker-in-Docker on systemd version 250 and later. moby/moby#46626
  • Fix dockerd-rootless-setuptools.sh when username contains a backslash. moby/moby#46407
  • Fix a bug that would prevent network sandboxes to be fully deleted when stopping containers with no network attachments and when dockerd --bridge=none is used. moby/moby#46702
  • Fix a bug where cancelling an API request could interrupt container restart. moby/moby#46697
  • Fix an issue where containers would fail to start when providing --ip-range with a range larger than the subnet. docker/for-mac#6870
  • Fix data corruption with zstd output. moby/moby#46709
  • Fix the conditions under which the container's MAC address is applied. moby/moby#46478
  • Improve the performance of the stats collector. moby/moby#46448
  • Fix an issue with source policy rules ending up in the wrong order. moby/moby#46441

Packaging updates

Security

Commits
  • 311b9ff Merge pull request #46697 from thaJeztah/24.0_backport_restart_nocancel
  • af60804 Merge pull request from GHSA-jq35-85cj-fj4p
  • 3cf363e Merge pull request #46709 from thaJeztah/24.0_backport_bump_compress
  • 05d7386 daemon: daemon.containerRestart: don't cancel restart on context cancel
  • 649c944 Merge pull request #46703 from thaJeztah/24.0_backport_atomic-layer-data-write
  • 9b20b1a Merge pull request #46702 from thaJeztah/24.0_backport_releaseNetwork_Network...
  • dd37b0b vendor: github.com/klauspost/compress v1.17.2
  • 7058c0d vendor: github.com/klauspost/compress v1.16.5
  • 57bd388 daemon: overlay2: Write layer metadata atomically
  • 05d95fd daemon: release sandbox even when NetworkDisabled
  • Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.13.0

What's Changed

... (truncated)

Commits
  • 94bd4af Merge pull request #1261 from BeChris/issue680
  • 8b7f5ba Merge pull request #1262 from go-git/dependabot/go_modules/github.com/elazarl...
  • 41d80a0 build: bump github.com/elazarl/goproxy
  • 4998140 git: worktree_commit, sanitize author and commiter name and email before crea...
  • 9049625 Merge pull request #1260 from go-git/dependabot/github_actions/github/codeql-...
  • dae48b4 build: bump github/codeql-action from 3.27.9 to 3.28.0
  • 7d6fbc2 Merge pull request #1220 from BeChris/accept_uppercase_hexa_in_pktline_length
  • 62a77b7 plumbing: Fix invalid reference name error while cloning branches containing ...
  • 5e11196 plumbing: format/pktline, accept upercase hexadecimal value as pktline length...
  • 65f5e1a Merge pull request #1256 from go-git/dependabot/go_modules/golang-org-232a611e2d
  • Additional commits viewable in compare view

Updates github.com/sigstore/rekor from 1.0.1 to 1.2.2

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.2.2

What's Changed

New Contributors

Full Changelog: sigstore/rekor@v1.2.1...v1.2.2

v1.2.1

Changelog

v1.2.1

  • 576458c run go mod tidy in hack/toolz (#1510)

(note the release of v1.2.0 failed during our release process, so we fixed the issue and cut v1.2.1); including the Changelog for v1.2.0 here too:

v1.2.0

Functional Enhancements

  • add client method to generate TLE struct (#1498)
  • add dsse type (#1487)
  • support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  • Add concurrency to backfill-redis (#1504)
  • omit informational message if machine-parseable output has been requested (#1486)
  • Publish stable checkpoint periodically to Redis (#1461)
  • Add intoto v0.0.2 to backfill script (#1500)
  • add new method to test insertability of proposed entries into log (#1410)

Quality Enhancements

  • use t.Skip() in fuzzers (#1506)
  • improve fuzzing coverage (#1499)
  • Remove watcher script (#1484)

Bug Fixes

  • Merge pull request from GHSA-frqx-jfcm-6jjr
  • Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  • fix lint errors, bump linter up to 1.52 (#1485)
  • Remove dependencies from pkg/util (#1469)

... (truncated)

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.2.2

Quality Enhancements

  • swap killswitch for 'docker-compose restart' (#1562)
  • pass treeSize and rootHash to avoid trillian import (#1513)
  • Move github.com/sigstore/protobuf-specs users into a separate subpackage (#1511)

Bug Fixes

  • pass down error with message instead of nil (#1560)

Contributors

  • Bob Callaway
  • Carlos Tadeu Panato Junior
  • Eng Zer Jun
  • Miloslav Trmač

v1.2.1

Bug Fixes

  • run go mod tidy in hack/tools (#1510)

Contributors

  • Bob Callaway

v1.2.0

Functional Enhancements

  • add client method to generate TLE struct (#1498)
  • add dsse type (#1487)
  • support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  • Add concurrency to backfill-redis (#1504)
  • omit informational message if machine-parseable output has been requested (#1486)
  • Publish stable checkpoint periodically to Redis (#1461)
  • Add intoto v0.0.2 to backfill script (#1500)
  • add new method to test insertability of proposed entries into log (#1410)

Quality Enhancements

  • use t.Skip() in fuzzers (#1506)
  • improve fuzzing coverage (#1499)
  • Remove watcher script (#1484)

Bug Fixes

  • Merge pull request from GHSA-frqx-jfcm-6jjr
  • Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  • fix lint errors, bump linter up to 1.52 (#1485)
  • Remove dependencies from pkg/util (#1469)

Contributors

  • Bob Callaway
  • Carlos Tadeu Panato Junior

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Feb 1, 2025
@rchincha
Copy link
Copy Markdown
Contributor

rchincha commented Mar 23, 2025

@dependabot rebase

@dependabot dependabot Bot force-pushed the dependabot/go_modules/go_modules-6389f97bc2 branch from 11e815a to 17e3b7f Compare March 23, 2025 06:02
@hallyn
Copy link
Copy Markdown
Contributor

hallyn commented Jul 5, 2025

@dependabot rebase

@dependabot
build(deps): Bump the go_modules group with 8 updates
4119d81 
Bumps the go_modules group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/containers/image/v5](https://github.com/containers/image) | `5.24.2` | `5.29.3` |
| [github.com/moby/buildkit](https://github.com/moby/buildkit) | `0.11.4` | `0.12.5` |
| [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope) | `0.0.0-20230925132944-bf05af58eb44` | `0.0.1` |
| [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | `1.3.3` | `1.3.7` |
| [github.com/containerd/containerd](https://github.com/containerd/containerd) | `1.7.0` | `1.7.11` |
| [github.com/docker/docker](https://github.com/docker/docker) | `24.0.6+incompatible` | `24.0.7+incompatible` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.11.0` | `5.13.0` |
| [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.0.1` | `1.2.2` |


Updates `github.com/containers/image/v5` from 5.24.2 to 5.29.3
- [Release notes](https://github.com/containers/image/releases)
- [Commits](containers/image@v5.24.2...v5.29.3)

Updates `github.com/moby/buildkit` from 0.11.4 to 0.12.5
- [Release notes](https://github.com/moby/buildkit/releases)
- [Commits](moby/buildkit@v0.11.4...v0.12.5)

Updates `github.com/anchore/stereoscope` from 0.0.0-20230925132944-bf05af58eb44 to 0.0.1
- [Release notes](https://github.com/anchore/stereoscope/releases)
- [Changelog](https://github.com/anchore/stereoscope/blob/main/RELEASE.md)
- [Commits](https://github.com/anchore/stereoscope/commits/v0.0.1)

Updates `github.com/cloudflare/circl` from 1.3.3 to 1.3.7
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](cloudflare/circl@v1.3.3...v1.3.7)

Updates `github.com/containerd/containerd` from 1.7.0 to 1.7.11
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v1.7.0...v1.7.11)

Updates `github.com/docker/docker` from 24.0.6+incompatible to 24.0.7+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v24.0.6...v24.0.7)

Updates `github.com/go-git/go-git/v5` from 5.11.0 to 5.13.0
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.11.0...v5.13.0)

Updates `github.com/sigstore/rekor` from 1.0.1 to 1.2.2
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.0.1...v1.2.2)

---
updated-dependencies:
- dependency-name: github.com/containers/image/v5
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/moby/buildkit
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/anchore/stereoscope
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/cloudflare/circl
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/containerd/containerd
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/docker/docker
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/sigstore/rekor
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/go_modules-6389f97bc2 branch from 17e3b7f to 4119d81 Compare July 5, 2025 12:39
@hallyn
Copy link
Copy Markdown
Contributor

hallyn commented Jul 9, 2025

@dependabot recreate

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Jul 9, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 9, 2025
@dependabot dependabot Bot deleted the dependabot/go_modules/go_modules-6389f97bc2 branch July 9, 2025 01:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hallyn hallyn hallyn approved these changes

@rchincha rchincha Awaiting requested review from rchincha rchincha is a code owner

@smoser smoser Awaiting requested review from smoser smoser is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@rchincha @hallyn