This repository was archived by the owner on Mar 31, 2025. It is now read-only.
chore(deps): update module github.com/containerd/containerd to v1.6.38 [security] #174
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…8 [security] Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Contributor
Author
ℹ Artifact update noticeFile name: app/platform/fabric/e2e-test/specs/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
![renovate-approve-2[bot]](https://avatars.githubusercontent.com/in/62175?s=60&v=4){kind=small}
Reviewer's Guide by SourceryThis PR updates the containerd dependency to v1.6.38 to address CVE-2024-40635, a security vulnerability that could allow containers to run as root. It also updates other dependencies for compatibility and bug fixes. No diagrams generated as the changes look simple and do not need a visual representation. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.6.26->v1.6.38GitHub Vulnerability Alerts
CVE-2024-40635
Impact
A bug was found in containerd where containers launched with a User set as a
UID:GIDlarger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.Patches
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images are used and that only trusted users have permissions to import images.
Credits
The containerd project would like to thank Benjamin Koltermann and emxll for responsibly disclosing this issue in accordance with the containerd security policy.
References
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Release Notes
containerd/containerd (github.com/containerd/containerd)
v1.6.38: containerd 1.6.38Compare Source
Welcome to the v1.6.38 release of containerd!
The thirty-eighth patch release for containerd 1.6 contains various fixes
and updates.
Highlights
Container Runtime Interface (CRI)
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
19 commits
cf158e884Merge commit from fork9639b9625validate uid/gideee34bac2Prepare release notes for v1.6.38b67a35bafmove exclude-dirs to issues.exclude-dirs2104a41efupdate golangci-lint to 1.60.1820e81adcupdate build to go1.23.7, test go1.24.17cc3b3dcee2e: use the shim bundled with containerd artifact0733895f3Remove unnecessary joinError unwrap054c4cc79Remove hashicorp/go-multierrorff21be0eeUpdate go to 1.20 to use its multi error supportf63b5fd3fupdate containerd/project-checks to 1.2.1abd1692cffix fatal error: concurrent map iteration and map writef5ab73c0aCI: arm64-8core-32gb -> ubuntu-24.04-arm2cc6b5b0aincrease xfs base image size to 300MbDependency Changes
This release has no dependency changes
Previous release can be found at v1.6.37
v1.6.37: containerd 1.6.37Compare Source
Welcome to the v1.6.37 release of containerd!
The thirty-seventh patch release for containerd 1.6 contains various fixes
and updates.
Highlights
Container Runtime Interface (CRI)
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
59 commits
16ba72ad9Prepare release notes for v1.6.373e6f219d7Add integ test to check tty leakbc20f7457fix master tty leak due to leaking init container objectcbd44298cUpdate install-imgcrypt to allow change install repo9918dc4e3Update runc binary to v1.2.5d92457c71Remove vagrant scp from the install list315a23dd9update runc binary to v1.2.479f6df6f4update runc binary to v1.2.3bf89950f5update build to go1.22.10, test go1.23.4db096794ffix panic due to nil dereference cgroups v23a0f138b0add almalinux/9 in CIaca1ca440add info of exited event4eaef56a2update runc binary to 1.2.2f42035a21Revert "Disable vagrant strict dependency checking"20958cbb0update build to go1.22.9, test go1.23.3edb3df5abDisable vagrant strict dependency checking9eca374a4Update critools-version to 1.29 in release 1.66134f736dupdate runc binary to 1.2.14e54972f0services/snapshots: include name of snapshotter in debug logsd7c7a12f3Make TestContainerPids more resiliente6d8e5e9cAdd After=dbus.service to containerd.serviceb1f8b03e7Handle teardown failure to avoid blocking cleanupba411483aSwitch from actuated.dev to GH Action runners for arm648c58f78c2Update github actions ci to run on forkse4211a530bump golangci/golangci-lint-action from 4 to 61ca261fe4update to go1.23.2,go1.22.81c96f2391Update runner images to macOS131ba7381cfBump crun to 1.16afc84d092CI: bump up crun to 1.1574951d6cfFix the race condition during GC of snapshots when client retriesca6516ee8[release/1.6] Add check for CNI plugins before tearing down pod networkDependency Changes
This release has no dependency changes
Previous release can be found at v1.6.36
v1.6.36: containerd 1.6.36Compare Source
Welcome to the v1.6.36 release of containerd!
The thirty-sixth patch release for containerd 1.6 contains various fixes
and updates.
Highlights
Build and Release Toolchain
Container Runtime Interface (CRI)
kubectl exec>= 1.30.0 (#10574)Runtime
Deprecations
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
32 commits
7fee84514Prepare release notes for v1.6.36ab9fedde2integration: regression test for issue 10589d0989e952fifosync: cross-process synchronizationc9617c321runc-shim: handle pending execs as running15ad6ac67runc-shim: refuse to start execs after init exits7e6a18c24runc-shim: remove misleading comment951af274cupdate to go1.22.7, go1.23.1c8e5b1eb6Cumulative stats can't decrease0bbc90aeeuse git clone to install gogo/protobuf383b2dcd1move builds to go1.22 and testing to go1.23fd70da38bupdate runc binary to 1.1.144fd7d4eefFix TestNewBinaryIOCleanup on Go 1.23 and Linux 5.4kubectl exec>= 1.30.0 (#10574)6f9efd3a9hide wsstream under internal/ to prevent external use4694b84e8golangci-lint should only look for problems in new code05c2b1413Run go mod tidya7b0c015dAdd copyright headers78f079926switch over references to the new package64430d636Fix up some constant referencesa37b08102Copy over wsstream from k8s v1.31.0-rc.1 released727961d2Update CRIAPIV1Alpha2 warning lastOccurrence every callbe0f0db07update to go1.21.13 / go1.22.6Dependency Changes
This release has no dependency changes
Previous release can be found at v1.6.35
v1.6.35: containerd 1.6.35Compare Source
Welcome to the v1.6.35 release of containerd!
The thirty-fifth patch release for containerd 1.6 contains various fixes
and updates.
Highlights
Container Runtime Interface (CRI)
StopPodSandboxRPC idempotent (#10531)Runtime
/run/containerdgets created with correct perms (#10535)Deprecations
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
24 commits
849650ab7Prepare release notes for v1.6.354ec5cd6bdFix TestNewBinaryIOCleanup failing with gotip9539b9b7bscript/setup/install-runc: fix runc using incorrect versionc3c2b4eecRevert "[release/1.7]: HPC working directory fix in pkg/cri/server code"65cf37bcbupdate auths code comment/run/containerdgets created with correct perms (#10535)b1ef73e76Ensure /run/containerd is created with correct permsStopContainerRPC idempotent (#10530)7134b03baMakeStopContainerRPC idempotentStopPodSandboxRPC idempotent (#10531)18ea8f288MakeStopPodSandboxRPC idempotented87e4787deprecation: update warnings for CRI config fields5c8818782client: fix tasks with PID 0 cannot be forced to deletea4846fc0dintrospection: regenerate UUID if state is empty484705c62Set stderr to empty string when using terminal on Windows.Dependency Changes
This release has no dependency changes
Previous release can be found at v1.6.34
v1.6.34: containerd 1.6.34Compare Source
Welcome to the v1.6.34 release of containerd!
The thirty-fourth patch release for containerd 1.6 contains various fixes
and updates.
Highlights
Container Runtime Interface (CRI)
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
26 commits
b2863e9e7Prepare release notes for v1.6.34b7d06a619CRI: An empty DNSConfig != unspecified8d2739857Support for dropping inheritable capabilitiesce685376ferrdefs: denote deprecation as a godoc comment634ae543dupdate to go1.21.12 / go1.22.5a0adb2933Updating hcsshim to 0.9.123ea0c4983golangci-lint: enable depguard for packages that moved086e1f56e[release/1.7]: HPC working directory fix in pkg/cri/server code166283a34integration: backport upgrade testsuite's utils990a05d0a*: export RemoveVolatileOption for CRI image volumesa894b5f81strip-volatile-option-tmp-mountsf6ef0071bupdate runc binary to v1.1.1389bb437f8Remove rocklinux 901fa3d0d7Backport version from box string in Vagrantfile0be3788f5Update Fedora and EL linux versionDependency Changes
Previous release can be found at v1.6.33
v1.6.33: containerd 1.6.33Compare Source
Welcome to the v1.6.33 release of containerd!
The thirty-third patch release for containerd 1.6 contains various updates along
with an updated version of Go. Go 1.22.4 and 1.21.11 include a fix for a symlink
time of check to time of use race condition during directory removal.
Highlights
github.com/containerd/log(#10271)errdefspackage togithub.com/containerd/errdefs(#10267)Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
14 commits
97e059626Prepare release notes for v1.6.33da9a04e54Includes fix for a symlink race on removegithub.com/containerd/log(#10271)a389bb305migrate logs imports to github.com/containerd/log moduleerrdefspackage togithub.com/containerd/errdefs(#10267)615fb03e4replace uses of github.com/containerd/containerd/errdefsc83be1b9emigrate errdefs package to github.com/containerd/errdefs moduled4d489496core/image: fix usage of "unknown" platform5eaf5f881Explicitly set release latest to falseb51f7445dbuild(deps): bump softprops/action-gh-release from 1 to 2Changes from containerd/errdefs
6 commits
78f3494Add Github actions configuration46f1770Add go.mod configuration959121aAdd README.md33a2275Add LICENSEDependency Changes
Previous release can be found at v1.6.32
v1.6.32: containerd 1.6.32Compare Source
Welcome to the v1.6.32 release of containerd!
The thirty-second patch release for containerd 1.6 contains various fixes and updates.
Highlights
Container Runtime Interface (CRI)
Image Distribution
Deprecations
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
53 commits
085dc4c0dPrepare release notes for v1.6.3206724baadBump go-winio to fix struct alignment on go1.22b2fdf63b7Update hcsshim for go1.22 fixes38607b59cAdd check for unsupported config versionsc65da6997Preserve CL_UNPRIVILEGED locked flags during remount of bind mounts6951203b1vendor: github.com/containerd/imgcrypt@v1.1.8a14e5ec8bvendor: golang.org/x/net@v0.23.0fd21d7818vendor: golang.org/x/net@v0.21.0d276debb0vendor: golang.org/x/net@v0.20.0f82033dcfvendor: golang.org/x/net@v0.19.0411c5e5e5vendor: golang.org/x/term@v0.17.06f053bd1fvendor: golang.org/x/sys@v0.18.0cfd8443cbvendor: golang.org/x/sys@v0.17.05b4facbd6Update toolchain to Go 1.21.10 and 1.22.357860c1b6Add lease test for metadata snapshotterb095401dfUpdate metadata snapshotter to lease on existsfd8d35752Update image-spec to v1.1.089b975d81go.mod: github.com/opencontainers/image-spec v1.1.0-rc3f3e8b2ca1CRI: "Fix" imageFSPath behavior68db74d19Snapshotters: Export the root pathcd9b74640Add exports to proxy plugin config83cf026b2Add platform config to proxy plugins63c41d003apparmor: Allow confined runc to kill containersb12c3b0c8Add deprecated HTTPFallback for package compatibility239955890Update HTTPFallback to handle tls handshake timeoutb2a0ac0b4Remove empty default tls configuration in ctrea9a8c608update to go1.21.9, go1.22.2c809fa268pod: CreatedAt time will be 269 years ago while creating cri network failed.6ddec44bdPrevent GC from schedule itself with 0 period.86a1a3a82vendor: revendor OTELe15d4a8b8Changes to configuring otel from env only2fda262a9Deprecate otel configsc80347ec5Adding unit tests to opentelemetry tracingf1a14a12afix bug that using invalid token to retry fetching layer9701cf998fix(cri): fix unexpected order of mounts since go 1.19Changes from containerd/imgcrypt
89 commits
956b4d3CHANGES: Updated CHANGES document for 1.1.8 release9e8e1c1ctr: Sync code with containerd v1.6.23 ctr7d2cca5build(deps): bump containerd from 1.6.20 to 1.6.230f2559ectr: Sync code with containerd v1.6.20 ctrc48dd78cmd: Copy IntToInt32Array into img package and use it6d48a4ebuild(deps): bump ocicrypt from 1.1.7 to 1.1.81bc94a2github: Use golangci-lint v1.54.1 and adjust config file9065f1dgithub: Test with go 1.21 and go 1.2074986f3go.mod: Require go 1.20a2a8273build(deps): bump google.golang.org/grpc from 1.47.0 to 1.53.0286470atest: Test creating and running of container with key file missingaa517cctest: Fix order of parameters and remove unnecessary key parameterec72311test: Add comments to test case2959ec0test: To be able to run testLocalKeys alone add missing env variablea7f2760build(deps): upgrade github.com/containerd/containerd from 1.6.18 to 1.6.20002abacimages: Change 'any' to 'anything' to avoid clash with built-in type 'any'5780eccimages: Replace unused function parameters with '_'7dc8592ci: Update golangci-lint to v1.52.290e4f77build(deps): bump github.com/opencontainers/runc from 1.1.2 to 1.1.58fc037ftests: Upgrade toml written by test case to version 20b31bebci: Run tests with go 1.19 and 1.20 (abandon 1.18)523674cbuild(deps): Update to minimum required go v1.1996a2314build(deps): Upgrade to github.com/containers/ocicrypt@v1.1.71c50555bulid(deps): Update to golang.org/x/net@v0.7.09645d39build(deps): Update to minimum required go v1.188daaa45build(deps): bump github.com/containerd/containerd from 1.6.12 to 1.6.1812e84f5README: Fix a typo4e5a73ebuild(deps): bump github.com/containerd/containerd from 1.6.8 to 1.6.1216a071bUpdate golangci-lint to v1.50.1981a3fdRemove references to package io/ioutil06827a1Update containerd project checks package in CIf6a39e1Update GitHub actions packages in CI workflow6383351Update GitHub actions CI workflow OS runner imagesb6e16dbCI/CD: Run CodeQL on PRs and once a month17e5e7fCHANGESConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.