Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update various dependencies to mitigate CVE warnings #493

Merged
merged 4 commits into from
Nov 19, 2021
Merged

Update various dependencies to mitigate CVE warnings #493

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d10c515
Update containerd and runc dependencies
hiddeco Nov 19, 2021
19eb3d5
Update docker/distribution to v2.7.0-rc.0
hiddeco Nov 19, 2021
f933cb5
Update docker/cli to v20.10.9
hiddeco Nov 19, 2021
4ce894a
Update opencontainers/image-spec to v1.0.2
hiddeco Nov 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 26 additions & 6 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,12 @@ require (
cloud.google.com/go/storage v1.16.0
github.com/Masterminds/semver/v3 v3.1.1
github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7
github.com/bshuster-repo/logrus-logstash-hook v1.0.2 // indirect
github.com/bugsnag/bugsnag-go v2.1.2+incompatible // indirect
github.com/bugsnag/panicwrap v1.3.4 // indirect
github.com/cyphar/filepath-securejoin v0.2.2
github.com/docker/go-metrics v0.0.1 // indirect
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
github.com/fluxcd/pkg/apis/meta v0.10.0
github.com/fluxcd/pkg/gittestserver v0.4.2
github.com/fluxcd/pkg/gitutil v0.1.0
Expand All @@ -20,16 +25,23 @@ require (
github.com/fluxcd/pkg/untar v0.1.0
github.com/fluxcd/pkg/version v0.1.0
github.com/fluxcd/source-controller/api v0.18.0
github.com/garyburd/redigo v1.6.3 // indirect
github.com/go-git/go-billy/v5 v5.3.1
github.com/go-git/go-git/v5 v5.4.2
github.com/go-logr/logr v0.4.0
github.com/gofrs/uuid v4.1.0+incompatible // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/googleapis/gax-go/v2 v2.1.0 // indirect
github.com/gorilla/handlers v1.5.1 // indirect
github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 // indirect
github.com/libgit2/git2go/v31 v31.6.1
github.com/minio/minio-go/v7 v7.0.10
github.com/onsi/ginkgo v1.16.4
github.com/onsi/gomega v1.14.0
github.com/spf13/pflag v1.0.5
github.com/yvasiyarov/go-metrics v0.0.0-20150112132944-c25f46c4b940 // indirect
github.com/yvasiyarov/gorelic v0.0.7 // indirect
github.com/yvasiyarov/newrelic_platform_go v0.0.0-20160601141957-9c099fbc30e9 // indirect
golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b
golang.org/x/net v0.0.0-20210825183410-e898025ed96a // indirect
golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f // indirect
Expand All @@ -47,11 +59,19 @@ require (
sigs.k8s.io/yaml v1.2.0
)

// required by https://github.com/helm/helm/blob/v3.6.0/go.mod
replace github.com/docker/distribution => github.com/docker/distribution v0.0.0-20191216044856-a8371794149d
// Required by https://github.com/helm/helm/blob/v3.6.3/go.mod,
// but overwritten with a newer version due to CVE-2017-11468.
replace github.com/docker/distribution => github.com/docker/distribution v2.7.0-rc.0+incompatible

// fix CVE-2021-41103
replace github.com/containerd/containerd => github.com/containerd/containerd v1.4.11
// Fix CVE-2021-41092
replace github.com/docker/cli => github.com/docker/cli v20.10.9+incompatible

// fix CVE-2021-30465
replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.0.0-rc95
// Fix CVE-2021-41103
// Fix CVE-2021-41190
replace github.com/containerd/containerd => github.com/containerd/containerd v1.4.12

// Fix CVE-2021-30465
replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.0.2

// Fix CVE-2021-41190
replace github.com/opencontainers/image-spec => github.com/opencontainers/image-spec v1.0.2
Loading