Snyk test #1
Open
Snyk test #1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The fix for Code-Hex/vz#131 is not in a tagged Code-Hex/vz release, but this can trigger crashes in vfkit. This commit updates Code-Hex/vz to latest git main to get this fix.
This updates all direct go modules to their latest version.
In the previous API, there was no way to detect before changing the
status, which would make it difficult for developers to handle the
following situations:
- When the virtual machine status is Stop, calling Pause may fail.
- When the virtual machine status is Pause, setting the status to
Pause again may fail.
In the previous solution, developers needed to first get the current
status of the virtual machine and then decide whether to proceed to the
next step. However, the current virtual machine status is very diverse
(see:
https://github.com/Code-Hex/vz/blob/bd29a7ea3d39465c4224bfb01e990e8c220a8449/virtualization.go#L23),
which would require developers to handle various cases perfectly. This
PR solves this problem.
This jumps from 0.1.1 to 0.5.0 to better reflect vfkit's maturity.
When ConnectVSockSync fails in watchWakeupNotifications(), the returned net.Conn contains a nil value, but is not a nil interface (ie checking it for `== nil` returns false). This means we'll try to call `Close()` on the connection, which will cause a nil pointer dereference. See https://go.dev/doc/faq#nil_error and https://groups.google.com/g/golang-nuts/c/wnH302gBa4I for details about this behaviour. This bug is fixed by returning a nil interface when `vsockDevice.Connect(uint32(port))` returns an error.
We're seeing highly reliable disk corruption in podman machine with the default configuration, and this fixes it for me. This looks like the same thing as lima-vm/lima@488c95c
This follows the instructions at https://github.com/snyk/actions/tree/master/golang
One last go module update before releasing.
This should fix this error on PRs from dependabot: ``` Error: Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-on-push for more information on how to configure these events. ```
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Test PR to see if the snyk scan succeeds or break because of
snyk auth