Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update various dependencies to mitigate CVE warnings #361

Merged
merged 3 commits into from
Nov 19, 2021
Merged

Update various dependencies to mitigate CVE warnings #361

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a2284e3
Update containerd and runc dependencies
hiddeco Nov 19, 2021
cd3220b
Update docker/distribution to v2.7.0-rc.0
hiddeco Nov 19, 2021
29aff2c
Update docker/cli to v20.10.9
hiddeco Nov 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 23 additions & 4 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,22 +5,35 @@ go 1.16
replace github.com/fluxcd/helm-controller/api => ./api

require (
github.com/bshuster-repo/logrus-logstash-hook v1.0.2 // indirect
github.com/bugsnag/bugsnag-go v2.1.2+incompatible // indirect
github.com/bugsnag/panicwrap v1.3.4 // indirect
github.com/docker/go-metrics v0.0.1 // indirect
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
github.com/fluxcd/helm-controller/api v0.13.0
github.com/fluxcd/pkg/apis/kustomize v0.1.0
github.com/fluxcd/pkg/apis/meta v0.10.0
github.com/fluxcd/pkg/runtime v0.12.0
github.com/fluxcd/source-controller/api v0.18.0
github.com/garyburd/redigo v1.6.3 // indirect
github.com/go-logr/logr v0.4.0
github.com/gofrs/uuid v4.1.0+incompatible // indirect
github.com/gorilla/handlers v1.5.1 // indirect
github.com/hashicorp/go-retryablehttp v0.6.8
github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 // indirect
github.com/onsi/ginkgo v1.16.4
github.com/onsi/gomega v1.15.0
github.com/spf13/pflag v1.0.5
github.com/yvasiyarov/go-metrics v0.0.0-20150112132944-c25f46c4b940 // indirect
github.com/yvasiyarov/gorelic v0.0.7 // indirect
github.com/yvasiyarov/newrelic_platform_go v0.0.0-20160601141957-9c099fbc30e9 // indirect
helm.sh/helm/v3 v3.7.1
k8s.io/api v0.22.1
k8s.io/apiextensions-apiserver v0.22.1
k8s.io/apimachinery v0.22.1
k8s.io/cli-runtime v0.22.1
k8s.io/client-go v0.22.1
rsc.io/letsencrypt v0.0.3 // indirect
sigs.k8s.io/controller-runtime v0.9.7
sigs.k8s.io/kustomize/api v0.10.0
sigs.k8s.io/yaml v1.2.0
Expand All @@ -29,12 +42,18 @@ require (
// Freeze Helm due to OOM issues https://github.com/fluxcd/helm-controller/issues/345
replace helm.sh/helm/v3 => helm.sh/helm/v3 v3.6.3

// Required by https://github.com/helm/helm/blob/v3.6.3/go.mod
replace github.com/docker/distribution => github.com/docker/distribution v0.0.0-20191216044856-a8371794149d
// Required by https://github.com/helm/helm/blob/v3.6.3/go.mod,
// but overwritten with a newer version due to CVE-2017-11468.
replace github.com/docker/distribution => github.com/docker/distribution v2.7.0-rc.0+incompatible

// Fix CVE-2021-41092
replace github.com/docker/cli => github.com/docker/cli v20.10.9+incompatible

// Fix CVE-2021-30465
replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.0.0-rc95
// Fix CVE-2021-41190
replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.0.2

// Fix CVE-2021-32760
// Fix CVE-2021-41103
replace github.com/containerd/containerd => github.com/containerd/containerd v1.4.11
// Fix CVE-2021-41190
replace github.com/containerd/containerd => github.com/containerd/containerd v1.4.12
Loading