build(deps): bump the oc-mirror-v2-version-updates group with 13 updates#1382
build(deps): bump the oc-mirror-v2-version-updates group with 13 updates#1382dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps the oc-mirror-v2-version-updates group with 13 updates: | Package | From | To | | --- | --- | --- | | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.20.8-0.20260114192324-795787c558e1` | `0.21.3` | | [github.com/operator-framework/operator-registry](https://github.com/operator-framework/operator-registry) | `1.50.0` | `1.65.0` | | [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) | `1.9.3` | `1.9.4` | | [github.com/spf13/cobra](https://github.com/spf13/cobra) | `1.10.1` | `1.10.2` | | [github.com/spf13/pflag](https://github.com/spf13/pflag) | `1.0.9` | `1.0.10` | | [github.com/vbauerster/mpb/v8](https://github.com/vbauerster/mpb) | `8.10.2` | `8.11.3` | | [go.podman.io/common](https://github.com/containers/container-libs) | `0.65.0` | `0.67.0` | | [go.podman.io/image/v5](https://github.com/containers/container-libs) | `5.37.0` | `5.39.1` | | [go.podman.io/storage](https://github.com/containers/container-libs) | `1.60.0` | `1.62.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.41.0` | `0.49.0` | | [golang.org/x/term](https://github.com/golang/term) | `0.34.0` | `0.41.0` | | [helm.sh/helm/v3](https://github.com/helm/helm) | `3.18.6` | `3.20.1` | | [github.com/docker/cli](https://github.com/docker/cli) | `29.0.3+incompatible` | `29.3.1+incompatible` | Updates `github.com/google/go-containerregistry` from 0.20.8-0.20260114192324-795787c558e1 to 0.21.3 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](https://github.com/google/go-containerregistry/commits/v0.21.3) Updates `github.com/operator-framework/operator-registry` from 1.50.0 to 1.65.0 - [Release notes](https://github.com/operator-framework/operator-registry/releases) - [Commits](operator-framework/operator-registry@v1.50.0...v1.65.0) Updates `github.com/sirupsen/logrus` from 1.9.3 to 1.9.4 - [Release notes](https://github.com/sirupsen/logrus/releases) - [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md) - [Commits](sirupsen/logrus@v1.9.3...v1.9.4) Updates `github.com/spf13/cobra` from 1.10.1 to 1.10.2 - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](spf13/cobra@v1.10.1...v1.10.2) Updates `github.com/spf13/pflag` from 1.0.9 to 1.0.10 - [Release notes](https://github.com/spf13/pflag/releases) - [Commits](spf13/pflag@v1.0.9...v1.0.10) Updates `github.com/vbauerster/mpb/v8` from 8.10.2 to 8.11.3 - [Release notes](https://github.com/vbauerster/mpb/releases) - [Commits](vbauerster/mpb@v8.10.2...v8.11.3) Updates `go.podman.io/common` from 0.65.0 to 0.67.0 - [Release notes](https://github.com/containers/container-libs/releases) - [Commits](containers/container-libs@common/v0.65.0...common/v0.67.0) Updates `go.podman.io/image/v5` from 5.37.0 to 5.39.1 - [Release notes](https://github.com/containers/container-libs/releases) - [Commits](containers/container-libs@image/v5.37.0...image/v5.39.1) Updates `go.podman.io/storage` from 1.60.0 to 1.62.0 - [Release notes](https://github.com/containers/container-libs/releases) - [Commits](containers/container-libs@storage/v1.60.0...storage/v1.62.0) Updates `golang.org/x/crypto` from 0.41.0 to 0.49.0 - [Commits](golang/crypto@v0.41.0...v0.49.0) Updates `golang.org/x/term` from 0.34.0 to 0.41.0 - [Commits](golang/term@v0.34.0...v0.41.0) Updates `helm.sh/helm/v3` from 3.18.6 to 3.20.1 - [Release notes](https://github.com/helm/helm/releases) - [Commits](helm/helm@v3.18.6...v3.20.1) Updates `github.com/docker/cli` from 29.0.3+incompatible to 29.3.1+incompatible - [Commits](docker/cli@v29.0.3...v29.3.1) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: github.com/operator-framework/operator-registry dependency-version: 1.65.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: github.com/sirupsen/logrus dependency-version: 1.9.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: oc-mirror-v2-version-updates - dependency-name: github.com/spf13/cobra dependency-version: 1.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: oc-mirror-v2-version-updates - dependency-name: github.com/spf13/pflag dependency-version: 1.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: oc-mirror-v2-version-updates - dependency-name: github.com/vbauerster/mpb/v8 dependency-version: 8.11.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: go.podman.io/common dependency-version: 0.67.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: go.podman.io/image/v5 dependency-version: 5.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: go.podman.io/storage dependency-version: 1.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: golang.org/x/crypto dependency-version: 0.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: golang.org/x/term dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: helm.sh/helm/v3 dependency-version: 3.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates - dependency-name: github.com/docker/cli dependency-version: 29.3.1+incompatible dependency-type: direct:production update-type: version-update:semver-minor dependency-group: oc-mirror-v2-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
WalkthroughUpdated Go toolchain version from 1.24.3 to 1.25.7. Refreshed module dependencies across primary and indirect Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 3: The Dockerfile's GO_VERSION variable is pinned to go1.23.5 but go.mod
requires Go 1.25.7; update the Dockerfile to set GO_VERSION to go1.25.7 (or
match the exact version string used in go.mod) so the build toolchain and go.mod
are consistent, and ensure any related references to GO_VERSION (build image
tags, download URLs) are updated accordingly to use go1.25.7.
- Line 42: The go.mod still pulls the vulnerable indirect module
github.com/docker/docker v28.5.2+incompatible; update go.mod to explicitly
require or replace github.com/docker/docker to v29.3.1 or later (matching the
upgraded github.com/docker/cli v29.3.1) so the vulnerable transitive version is
resolved, or add a clear justification in the repository docs explaining why
github.com/docker/docker is unreachable in your threat model; locate and change
the go.mod entry for github.com/docker/docker and run go mod tidy to ensure the
new version is used.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e9fcbcba-e3b8-4b3c-85f3-0749946a5ff1
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| module github.com/openshift/oc-mirror/v2 | ||
|
|
||
| go 1.24.3 | ||
| go 1.25.7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check repo pins for Go versions in common automation files.
set -euo pipefail
echo "== go directive =="
rg -n --no-heading '^go\s+[0-9]+\.[0-9]+(\.[0-9]+)?$' go.mod
echo
echo "== setup-go / golang image version pins in workflows and docs =="
rg -n --no-heading 'setup-go|go-version|golang:|GO_VERSION|go1\.[0-9]+' .github README.md Makefile Dockerfile* 2>/dev/null || trueRepository: openshift/oc-mirror
Length of output: 351
🏁 Script executed:
#!/bin/bash
# More comprehensive search for all Go version pins
echo "== All Dockerfile variants =="
find . -type f \( -name "Dockerfile*" -o -name "dockerfile*" \) | head -20
echo
echo "== GitHub Actions workflows =="
find .github/workflows -type f -name "*.yml" -o -name "*.yaml" 2>/dev/null | head -20
echo
echo "== Go version references in workflows =="
rg -n 'go-version|uses:.*setup-go' .github 2>/dev/null || echo "No matches in .github"
echo
echo "== Build scripts and other files =="
find . -type f \( -name "*.sh" -o -name "Makefile*" -o -name "*.mk" \) | grep -v node_modules | grep -v ".git" | head -20Repository: openshift/oc-mirror
Length of output: 1824
🏁 Script executed:
#!/bin/bash
# Check key Dockerfiles and build scripts for Go version pins
echo "== Main Dockerfile =="
grep -n "GO_VERSION\|go1\." ./Dockerfile || echo "No matches"
echo
echo "== Docker CI/test variants =="
for f in ./images/cli/Dockerfile.{art,ci,test}; do
if [ -f "$f" ]; then
echo "File: $f"
grep -n "GO_VERSION\|go1\." "$f" || echo " No matches"
fi
done
echo
echo "== Makefile =="
grep -n "GO_VERSION\|go1\." ./Makefile ./v1/Makefile 2>/dev/null || echo "No matches"
echo
echo "== hack/build.sh =="
if [ -f ./hack/build.sh ]; then
grep -n "GO_VERSION\|go1\." ./hack/build.sh || echo "No matches"
fi
echo
echo "== Check for .github directory =="
ls -la .github 2>/dev/null || echo "No .github directory"Repository: openshift/oc-mirror
Length of output: 842
Update Dockerfile to use Go 1.25.7
The Dockerfile pins GO_VERSION=go1.23.5 but go.mod specifies go 1.25.7. This mismatch will cause build failures. Update the Dockerfile to match the go.mod version.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 3, The Dockerfile's GO_VERSION variable is pinned to go1.23.5
but go.mod requires Go 1.25.7; update the Dockerfile to set GO_VERSION to
go1.25.7 (or match the exact version string used in go.mod) so the build
toolchain and go.mod are consistent, and ensure any related references to
GO_VERSION (build image tags, download URLs) are updated accordingly to use
go1.25.7.
|
|
||
| require ( | ||
| github.com/docker/cli v29.0.3+incompatible | ||
| github.com/docker/cli v29.3.1+incompatible |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify vulnerable module is still present and whether any replace mitigates it.
set -euo pipefail
echo "== docker/docker entries in go.mod/go.sum =="
rg -n --no-heading 'github\.com/docker/docker|github\.com/docker/cli' go.mod go.sum || true
echo
echo "== replace directives referencing docker modules (if any) =="
rg -n --no-heading '^\s*replace\s+github\.com/docker/(docker|cli)' go.mod || trueRepository: openshift/oc-mirror
Length of output: 1015
🌐 Web query:
GHSA-pxq6-2prw-chj9 docker/docker CVE vulnerability
💡 Result:
GHSA-pxq6-2prw-chj9 is a moderate severity (CVSS 6.8) vulnerability in Moby (the open-source project behind Docker Engine), also tracked as CVE-2026-33997. It involves an off-by-one error (CWE-193) in the Docker daemon's plugin privilege validation logic during docker plugin install. Key details: - Affected versions: Moby/Docker Engine < 29.3.1 (github.com/moby/moby < 29.3.1, github.com/moby/moby/v2 vulnerable at 2.0.0-beta.7) - Fixed in: 29.3.1 (github.com/moby/moby/v2 >= 2.0.0-beta.8) - Impact: Malicious plugins can bypass privilege checks, gaining unintended permissions (e.g., broad device access). No impact if plugins are not used. Exploitation requires user approval of a malicious plugin install; Docker Desktop does not support plugins. - CVSS v3.1: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Patch: moby/moby@f4d6f25 - Workarounds: Avoid untrusted plugins, review privileges carefully, restrict daemon access. - Reported by: Cody (c@wormhole.guru) Note: Docker plugins are legacy and uncommon; official docs: https://docs.docker.com/engine/extend/legacy_plugins/. NVD entry pending as of 2026-03-30.
Citations:
- 1: https://osv.dev/vulnerability/GHSA-pxq6-2prw-chj9
- 2: https://advisories.gitlab.com/pkg/golang/github.com/moby/moby/v2/CVE-2026-33997/
- 3: GHSA-pxq6-2prw-chj9
- 4: x/vulndb: potential Go vuln in github.com/moby/moby/v2: GHSA-pxq6-2prw-chj9 golang/vulndb#4883
- 5: https://access.redhat.com/security/cve/CVE-2026-33997
- 6: https://vulert.com/vuln-db/CVE-2026-33997
- 7: https://advisories.gitlab.com/pkg/golang/github.com/docker/docker/CVE-2026-33997/
- 8: https://www.tenable.com/cve/CVE-2026-33997
🌐 Web query:
GHSA-x744-4wpc-v9h2 docker/docker CVE vulnerability
💡 Result:
GHSA-x744-4wpc-v9h2 is a high-severity vulnerability (CVSS 8.8) in Moby (Docker Engine), also known as CVE-2026-34040. It allows attackers to bypass authorization plugins (AuthZ) using oversized request bodies in specially-crafted API requests. The Docker daemon forwards the request to the plugin without the body, potentially allowing requests that would otherwise be denied if the body was inspected. This is an incomplete fix for the prior CVE-2024-41110 (GHSA-v23v-6jw2-98fq). Affected: Moby/Docker Engine versions < 29.3.1 (Go package github.com/moby/moby). Patched: Version 29.3.1. Impact: Only affects users of AuthZ plugins that inspect request bodies for access control. Low base exploit likelihood. CWE-863 (Incorrect Authorization). Workarounds: Avoid AuthZ plugins relying on body inspection; restrict Docker API access to trusted parties. Published: 2026-03-27. Official advisory: GHSA-x744-4wpc-v9h2
Citations:
- 1: https://osv.dev/vulnerability/GHSA-x744-4wpc-v9h2
- 2: https://vulnerability.circl.lu/vuln/ghsa-x744-4wpc-v9h2
- 3: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-34040
- 4: GHSA-x744-4wpc-v9h2
- 5: https://advisories.gitlab.com/pkg/golang/github.com/docker/docker/CVE-2026-34040/
🌐 Web query:
docker/cli v29.3.1 dependencies docker/docker version
💡 Result:
docker/cli v29.3.1 is the CLI component of Docker Engine v29.3.1. It is a Go project without a standard go.mod file (marked as +incompatible in pkg.go.dev), built with Go runtime 1.25.8. Key updates in this release include packaging updates like containerd to v2.2.2 (in engine) and Go SDK fixes for build tags. No complete dependency list is explicitly stated in sources, but it depends on moby/moby components for API compatibility. Docker Engine (docker/docker) version corresponding is v29.3.1, released 2026-03-25.
Citations:
- 1: https://pkg.go.dev/github.com/docker/cli
- 2: https://docs.docker.com/engine/release-notes/29/
- 3: https://github.com/docker/cli
- 4: [29.x backport] update to go1.25.8 docker/cli#6883
🌐 Web query:
github.com/docker/cli v29.3.1 go.mod moby/moby version dependencies
💡 Result:
The github.com/docker/cli repository at version v29.3.1 does not appear to have a standard go.mod file defining module dependencies in the conventional sense, as indicated by the "+incompatible" suffix on pkg.go.dev (https://pkg.go.dev/github.com/docker/cli@v29.3.1+incompatible). This means it is treated as a legacy GOPATH-style package without full Go modules support. The docker/cli project vendors its dependencies, including the Docker Engine client code previously from github.com/docker/docker (now deprecated), which has transitioned to github.com/moby/moby modules (client and api) starting with Docker v29. Vendor updates are done via PRs like docker/cli#6193, which bumped github.com/docker/docker to master (v29.0-dev). No explicit require for github.com/moby/moby is stated in sources for v29.3.1, but the CLI depends on the vendored Docker client code from moby/moby at the version aligned with Docker Engine v29.3.1 (tagged docker-v29.3.1 in moby/moby). Official docs reference parallel milestones for docker/cli 29.3.1 and moby/moby 29.3.1.
Citations:
- 1: https://pkg.go.dev/github.com/docker/cli
- 2: https://docs.docker.com/engine/release-notes/29/
- 3: missing release tag v29.3.1 moby/moby#52266
- 4: [29.x backport] cli/command: add missing "go:build" comments docker/cli#6884
- 5: vendor: github.com/docker/docker master (v29.0-dev) docker/cli#6193
- 6: https://github.com/docker/cli
Docker dependency update incomplete: github.com/docker/docker v28.5.2 remains vulnerable
Updating github.com/docker/cli to v29.3.1 does not automatically resolve the indirect github.com/docker/docker v28.5.2+incompatible dependency, which has known vulnerabilities:
- GHSA-x744-4wpc-v9h2 (HIGH, CVSS 8.8): AuthZ plugin bypass via oversized request bodies
- GHSA-pxq6-2prw-chj9 (MODERATE, CVSS 6.8): Plugin privilege validation bypass
Both are fixed in v29.3.1+. Add an explicit require/replace for github.com/docker/docker to v29.3.1 or later, or document why this dependency is not reachable in your threat model.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 42, The go.mod still pulls the vulnerable indirect module
github.com/docker/docker v28.5.2+incompatible; update go.mod to explicitly
require or replace github.com/docker/docker to v29.3.1 or later (matching the
upgraded github.com/docker/cli v29.3.1) so the vulnerable transitive version is
resolved, or add a clear justification in the repository docs explaining why
github.com/docker/docker is unreachable in your threat model; locate and change
the go.mod entry for github.com/docker/docker and run go mod tidy to ensure the
new version is used.
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
|
@dependabot[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Bumps the oc-mirror-v2-version-updates group with 13 updates:
0.20.8-0.20260114192324-795787c558e10.21.31.50.01.65.01.9.31.9.41.10.11.10.21.0.91.0.108.10.28.11.30.65.00.67.05.37.05.39.11.60.01.62.00.41.00.49.00.34.00.41.03.18.63.20.129.0.3+incompatible29.3.1+incompatibleUpdates
github.com/google/go-containerregistryfrom 0.20.8-0.20260114192324-795787c558e1 to 0.21.3Release notes
Sourced from github.com/google/go-containerregistry's releases.
... (truncated)
Commits
Updates
github.com/operator-framework/operator-registryfrom 1.50.0 to 1.65.0Release notes
Sourced from github.com/operator-framework/operator-registry's releases.
... (truncated)
Commits
21f9b55Bump codecov/codecov-action from 5 to 6 (#1941)070a649Bump github.com/operator-framework/api from 0.41.0 to 0.42.0 (#1940)2095729render package-level info from channel head in semver template (#1933)7b22611Bump github.com/docker/cli (#1939)2aade62Bump github.com/grpc-ecosystem/grpc-health-probe from 0.4.46 to 0.4.47 (#1937)d1d3906Bump the k8s-dependencies group with 4 updates (#1936)6ea0f39Bump google.golang.org/grpc from 1.79.2 to 1.79.3 (#1935)8ef7f30Bump github.com/mattn/go-sqlite3 from 1.14.34 to 1.14.37 (#1934)d47604fchore(lint): Upgrade golanglint from v2.7.2 to v2.8.0 and fix lint issues" (...4fef652Bump the golang-x-deps group with 2 updates (#1932)Updates
github.com/sirupsen/logrusfrom 1.9.3 to 1.9.4Release notes
Sourced from github.com/sirupsen/logrus's releases.
Changelog
Sourced from github.com/sirupsen/logrus's changelog.
Commits
b61f268Merge pull request #1472 from goldlinker/master15c29dbrefactor: replace the deprecated function in the ioutil packagecb253f3Merge pull request #1464 from thaJeztah/touchup_godoc29b2337Merge pull request #1468 from thaJeztah/touchup_readmed916819Merge pull request #1427 from dolmen/fix-testify-usage135e482README: small touch-ups2c5fa36Merge pull request #1467 from thaJeztah/rm_old_badge877ececREADME: remove travis badge55cf256Merge pull request #1393 from jsoref/grammar21bae50Merge pull request #1426 from dolmen/testing-fix-use-of-math-randUpdates
github.com/spf13/cobrafrom 1.10.1 to 1.10.2Release notes
Sourced from github.com/spf13/cobra's releases.
Commits
88b30abchore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 (#2336)346d408fix: actions/setup-go v6 (#2337)fc81d20refactor: change minUsagePadding from var to const (#2325)117698arefactor: replace several vars with consts (#2328)e2dd29dAdd documentation for repeated flags functionality (#2316)0629892Fix linter (#2327)Updates
github.com/spf13/pflagfrom 1.0.9 to 1.0.10Release notes
Sourced from github.com/spf13/pflag's releases.
Commits
0491e57Merge pull request #448 from thaJeztah/fix_go_version72abab1Merge pull request #447 from thaJeztah/fix_deprecation_comment7e4dfb1Test on Go 1.1218a9d17move Func, BoolFunc, tests as they require go1.21c5b9e98remove uses of errors.Is, which requires go1.1345a4873fix deprecation comment for (FlagSet.)ParseErrorsWhitelistUpdates
github.com/vbauerster/mpb/v8from 8.10.2 to 8.11.3Release notes
Sourced from github.com/vbauerster/mpb/v8's releases.
Commits
2056e7av8.11.3779decego get -ue914fa2(*Bar).SetRefillCurrent3304512v8.11.271a23abgo get -ua6ad7a7minor: comment68f7b23refactoring heapManager: no need to for extra goroutine641f03brefactoring heapManager: no need for h_end caseb4bd98cbar EwmaIncr: no need for sync.WaitGroup8c0512dminor: simplify with cmp.OrUpdates
go.podman.io/commonfrom 0.65.0 to 0.67.0Release notes
Sourced from go.podman.io/common's releases.
Commits
078c746[podman-5.8] Common to v0.67.06d3663d[podman-5.8] Bump image to v5.39.1, storage to v1.62.0071bdd3Merge pull request #630 from TomSweeneyRedHat/dev/tsweeney/dance-5.8-380fb329[podman-5.8] Bump to image 5.39.1c41710e[podman-5.8] Add missing image go.sum117e15bMerge pull request #629 from TomSweeneyRedHat/dev/tsweeney/dance-5.8-2a1da33b[podman-5.8] Bump image to v5.39.0d5d959a[podman-5.8] Bump storage to 1.62.0 in imageb4ff26eMerge pull request #626 from TomSweeneyRedHat/dev/tsweeney/dance-5.8-1bb290dc[podman-5.8] Bump storage to v1.62.0Updates
go.podman.io/image/v5from 5.37.0 to 5.39.1Commits
80fb329[podman-5.8] Bump to image 5.39.1c41710e[podman-5.8] Add missing image go.suma1da33b[podman-5.8] Bump image to v5.39.0d5d959a[podman-5.8] Bump storage to 1.62.0 in imageb4ff26eMerge pull request #626 from TomSweeneyRedHat/dev/tsweeney/dance-5.8-1bb290dc[podman-5.8] Bump storage to v1.62.0a79d33cMerge pull request #616 from l0rd/pr-612-to-5.890383dfcommon: safer use offilepath.EvalSymlinks()infindBindir()89d4270Merge pull request #601 from Luap99/podman-5.8d1241f8fix debug log for #579Updates
go.podman.io/storagefrom 1.60.0 to 1.62.0Commits
bb290dc[podman-5.8] Bump storage to v1.62.0a79d33cMerge pull request #616 from l0rd/pr-612-to-5.890383dfcommon: safer use offilepath.EvalSymlinks()infindBindir()89d4270Merge pull request #601 from Luap99/podman-5.8d1241f8fix debug log for #57932a8375Add DockerProxy field for dynamic proxy configurationd938980seccomp: block AF_VSOCK sockets857c346Set the MIME type on created OCI indices/manifestsffb4375idtools: avoid direct use of C.stderr to fix musl cgo build failures52ca8fbCleanup manpage formattingUpdates
golang.org/x/cryptofrom 0.41.0 to 0.49.0Commits
982eaa6go.mod: update golang.org/x dependencies159944fssh,acme: clean up tautological/impossible nil conditionsa408498acme: only require prompt if server has terms of servicecab0f71all: upgrade go directive to at least 1.25.0 [generated]2f26647x509roots/fallback: update bundlee08b067go.mod: update golang.org/x dependencies7d0074cscrypt: fix panic on parameters <= 0506e022go.mod: update golang.org/x dependencies7dacc38chacha20poly1305: error out in fips140=only mode19acf81go.mod: update golang.org/x dependenciesUpdates
golang.org/x/termfrom 0.34.0 to 0.41.0Commits
9d2dc07go.mod: update golang.org/x dependenciesd954e03all: upgrade go directive to at least 1.25.0 [generated]3aff304go.mod: update golang.org/x dependenciesa7e5b04go.mod: update golang.org/x dependencies943f25dx/term: handle transpose9b991ddx/term: handle delete key3863673go.mod: update golang.org/x dependencies1231d54go.mod: update golang.org/x dependencies3475bc8term: fix some comments3a0828ago.mod: update golang.org/x dependenciesUpdates
helm.sh/helm/v3from 3.18.6 to 3.20.1Release notes
Sourced from helm.sh/helm/v3's releases.
... (truncated)
Commits
a2369cachore(deps): bump the k8s-io group with 7 updates90e1056add image index test911f2e9fix pulling charts from OCI indices76dad33Remove refactorring changes from coalesce_test.go45c12f7Fix import26c6f19Update pkg/chart/common/util/coalesce_test.go09f5129Fix lint warning417deb2Preserve nil values in chart already5417bfafix(values): preserve nil values when chart default is empty mapb2e4314Merge pull request #31718 from scottrigby/bump-3.20Updates
github.com/docker/clifrom 29.0.3+incompatible to 29.3.1+incompatibleCommits
c2be9ccMerge pull request #6887 from thaJeztah/29.x_backport_pin_actions0da6a51ci: pin actions to digests6b3ca8fMerge pull request #6884 from thaJeztah/29.x_backport_missing_buildtagsf47603cMerge pull request #6885 from thaJeztah/29.x_backport_update_actions9709c8fbuild(deps): bump docker/metadata-action from 5 to 6af45a23build(deps): bump docker/bake-action from 6 to 7bc97f5aMerge pull request #6883 from thaJeztah/29.x_backport_update_go1.25.86d71967cli/command: add missing "go:build" comments9b51892update to go1.25.85927d80Merge pull request #6844 from vvoland/update-dockerDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions