Skip to content

Bump github.com/containerd/containerd from 1.6.18 to 1.6.38 #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Mar 18, 2025

Bumps github.com/containerd/containerd from 1.6.18 to 1.6.38.

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.6.38

Welcome to the v1.6.38 release of containerd!

The thirty-eighth patch release for containerd 1.6 contains various fixes and updates.

Highlights

Container Runtime Interface (CRI)

  • Fix fatal map concurrency error in httpstream (#11319)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Jin Dong
  • Akhil Mohan
  • Derek McGowan
  • Phil Estes
  • Akihiro Suda
  • Craig Ingram
  • Kohei Tokunaga
  • Maksym Pavlenko
  • Samuel Karp
  • ningmingxiao

Changes

  • cf158e884 Merge commit from fork
  • 9639b9625 validate uid/gid
  • Prepare release notes for v1.6.38 (#11539)
    • eee34bac2 Prepare release notes for v1.6.38
  • update build to go1.23.7, test go1.24.1 (#11421)
    • b67a35baf move exclude-dirs to issues.exclude-dirs
    • 2104a41ef update golangci-lint to 1.60.1
    • 820e81adc update build to go1.23.7, test go1.24.1
  • Remove hashicorp/go-multierror dependency and fix CI (#11500)
    • 7cc3b3dce e2e: use the shim bundled with containerd artifact
    • 0733895f3 Remove unnecessary joinError unwrap
    • 054c4cc79 Remove hashicorp/go-multierror
    • ff21be0ee Update go to 1.20 to use its multi error support
    • f63b5fd3f update containerd/project-checks to 1.2.1
  • Fix fatal map concurrency error in httpstream (#11319)
    • abd1692cf fix fatal error: concurrent map iteration and map write

... (truncated)

Commits
  • cf158e8 Merge commit from fork
  • e0c4dd9 Merge pull request #11539 from dmcgowan/prepare-1.6.38
  • eee34ba Prepare release notes for v1.6.38
  • 9639b96 validate uid/gid
  • 7b54421 Merge pull request #11421 from akhilerm/1.6-update-go1.24
  • b67a35b move exclude-dirs to issues.exclude-dirs
  • 2104a41 update golangci-lint to 1.60.1
  • 820e81a update build to go1.23.7, test go1.24.1
  • 176129f Merge pull request #11500 from djdongjin/1-6-remove-hashi-multierror
  • 7cc3b3d e2e: use the shim bundled with containerd artifact
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by Bito

This PR updates multiple dependency versions in go.mod, primarily upgrading containerd from 1.6.18 to 1.6.38 to incorporate important bug fixes. Additional updates include logr, xxhash, go-restful, and various golang/google packages to enhance stability and compatibility with latest releases.

Unit tests added: False

Estimated effort to review (1-5, lower is better): 2

Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.6.18 to 1.6.38.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v1.6.18...v1.6.38)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 18, 2025
Copy link

bito-code-review bot commented Mar 18, 2025

Code Review Agent Run #f50720

Actionable Suggestions - 0
Security Concerns - 8
  • Vulnerability 1
    • Dependency Name: golang.org/x/oauth2
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3488
    • Vulnerability Description: An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
    • Fixed in Version: v0.27.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - golang.org/x/oauth2 v0.26.0
      + golang.org/x/oauth2 v0.27.0
      
  • Vulnerability 2
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2024-2687
    • Vulnerability Description: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.
    • Fixed in Version: v1.21.9
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - go 1.21.8
      + go 1.21.9
      
  • Vulnerability 3
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2024-2887
    • Vulnerability Description: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses.
    • Fixed in Version: v1.21.11
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - go 1.21.9
      + go 1.21.11
      
  • Vulnerability 4
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2024-2963
    • Vulnerability Description: The net/http HTTP/1.1 client mishandling could leave a client connection in an invalid state, causing denial of service.
    • Fixed in Version: v1.21.12
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - go 1.21.11
      + go 1.21.12
      
  • Vulnerability 5
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2024-3105
    • Vulnerability Description: Calling Parse functions on Go source code with deeply nested literals can cause a panic due to stack exhaustion.
    • Fixed in Version: v1.22.7
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - go 1.21.12
      + go 1.22.7
      
  • Vulnerability 6
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2024-2687
    • Vulnerability Description: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.
    • Fixed in Version: v0.23.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - golang.org/x/net v0.22.0
      + golang.org/x/net v0.23.0
      
  • Vulnerability 7
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2024-3333
    • Vulnerability Description: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
    • Fixed in Version: v0.33.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - golang.org/x/net v0.23.0
      + golang.org/x/net v0.33.0
      
  • Vulnerability 8
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3503
    • Vulnerability Description: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component.
    • Fixed in Version: v0.36.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - golang.org/x/net v0.33.0
      + golang.org/x/net v0.36.0
      
Review Details
  • Files reviewed - 1 · Commit Range: ad21c19..ad21c19
    • go.mod
  • Files skipped - 1
    • go.sum - Reason: Filter setting
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • SNYK (Security Vulnerability) - ✔︎ Successful
    • OWASP (Security Vulnerability) - ✔︎ Successful
    • GOVULNCHECK (Security Vulnerability) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at [email protected].

Documentation & Help

AI Code Review powered by Bito Logo

Copy link

Changelist by Bito

This pull request implements the following key changes.

Key Change Files Impacted
Other Improvements - Dependency Updates

go.mod - Updated multiple dependency versions including github.com/containerd/containerd (1.6.18 to 1.6.38), logr, xxhash, go-restful, and various golang/x and google packages; also removed an unused dependency.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants