Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update containerd/containerd indirect test dep #15816

Merged
merged 2 commits into from Jun 13, 2022

Conversation

cipherboy
Copy link
Contributor

@cipherboy cipherboy commented Jun 6, 2022

This dependency is pulled in from our testing infra and not in our final
Vault version. However, updating this dep pulls in newer versions of
other deps (such as protobuf) which are used at runtime. Updated via:

$ go get github.com/containerd/containerd@v1.5.13 && go mod tidy

Since docker/docker has an indirect dep on containerd, I've updated it
as well:

$ go get github.com/docker/docker@v20.10.17 && go mod tidy

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>


Inclined not to backport to 1.11 since this is a testing dep. Anyone know if we need to update vault-testing-stepwise as well?

Inclined not to add a changelog as the motivation was for the containerd test dep, but if others feel the other updates warrant a changelog, happy to add one.

Resolves: #15639

/cc @mickael-hc

@cipherboy cipherboy added the bug Used to indicate a potential bug label Jun 6, 2022
@cipherboy cipherboy added this to the 1.12.0-rc1 milestone Jun 6, 2022
@cipherboy cipherboy requested review from a team June 6, 2022 16:38
Copy link
Contributor

@swenson swenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cipherboy cipherboy marked this pull request as draft June 6, 2022 22:07
@cipherboy
Copy link
Contributor Author

Marking draft until shirou/gopsutil#1310 is resolved to fix the build.

@stevendpclark
Copy link
Contributor

Note that CVE-2022-31030 has come out since so we should also bump github.com/containerd/containerd to 1.5.13

This dependency is pulled in from our testing infra and not in our final
Vault version. However, updating this dep pulls in newer versions of
other deps (such as protobuf) which are used at runtime. Updated via:

$ go get github.com/containerd/containerd@v1.5.13 && go mod tidy

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Since docker/docker has an indirect dep on containerd, I've updated it
as well:

$ go get github.com/docker/docker@v20.10.16 && go mod tidy

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
@cipherboy cipherboy force-pushed the cipherboy-fix-docker-version branch from 8931bb9 to a18bdea Compare June 13, 2022 14:47
@cipherboy cipherboy marked this pull request as ready for review June 13, 2022 14:47
@cipherboy
Copy link
Contributor Author

Per conversation with @ncabatoff, by using go get rather than go get -u, I've avoided the x/sys update. I've also pulled in the newer containerd/container and docker/docker versions @stevendpclark.

@cipherboy
Copy link
Contributor Author

Thanks all! Merging...

@cipherboy cipherboy merged commit cef0bd7 into main Jun 13, 2022
@cipherboy cipherboy deleted the cipherboy-fix-docker-version branch June 16, 2022 15:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Used to indicate a potential bug pr/no-changelog
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Bump up containerd version to fix CVE-2021-43816
3 participants