Commit graph

13 commits

Author SHA1 Message Date
Davanum Srinivas
c825d80bbf Update security-critical authentication and protobuf dependencies
This PR updates security-critical dependencies addressing authentication
and data parsing vulnerabilities.

**Authentication Security:**
- github.com/coreos/go-oidc: v2.3.0 -> v2.5.0
  - Security fix: Now verifies token signature BEFORE validating payload
  - Prevents potential processing of tampered tokens before cryptographic
    verification

- github.com/cyphar/filepath-securejoin: v0.6.0 -> v0.6.1
  - Security fix: Fixed seccomp fallback logic - library now properly falls
    back to safer O_PATH resolver when openat2(2) is denied by seccomp-bpf
  - Fixed file descriptor leak in openat2 wrapper during RESOLVE_IN_ROOT

- cyphar.com/go-pathrs: v0.2.1 -> v0.2.2
  - Companion update to filepath-securejoin

**Protobuf Security:**
- google.golang.org/protobuf: v1.36.8 -> v1.36.11
  - Security fix: Added recursion limit check in lazy decoding validation
  - Prevents potential stack exhaustion attacks via maliciously crafted
    protobuf messages
  - Also adds support for URL chars in type URLs in text-format

These updates are critical for:
- OIDC authentication in kube-apiserver
- Container filesystem path resolution (used by container runtimes)
- Protobuf message parsing throughout the codebase

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-13 16:56:16 -05:00
Benjamin Elder
1ce140d105 update github.com/opencontainers/selinux to v1.13.0 2025-11-12 14:46:31 +00:00
Davanum Srinivas
5ecddb6571
update to latest cadvisor @ v0.52.0
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2025-03-05 06:36:39 -05:00
Stephen Kitt
68ab918df7
Bump filepath-securejoin to 0.3.5
This release fixes a race in MkdirAll; the latter isn't currently used
in k/k, but it seems safer to upgrade to avoid issues if it starts
being used.

The latest version is 0.3.6 but that only reduces the Go requirements,
which isn't relevant for k/k and adds a couple hundred lines of code.

Signed-off-by: Stephen Kitt <skitt@redhat.com>
2024-12-17 19:46:03 +01:00
Kir Kolyshkin
1d4f88b1ee vendor: bump runc to v1.2.1
For one thing, this release decouples device management from
libcontainer/cgroups. You can see the result of this in a dropped
cilium/ebpf dependency (which is only needed for device management).

NOTE that due to an issue with go mod / go list,
github.com/opencontainers/runc had to be added to
hack/unwanted-dependencies.json under x/exp. This is bogus because
opencontainers/runc does not use x/exp directly, only via cilium/ebpf
dependency (which is not vendored here).

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2024-11-01 17:26:09 -07:00
lvedder
fced85b27a run hack scripts to update cyphar/filepath-securejoin to v0.2.4 correctly 2023-10-17 10:58:11 +02:00
Jordan Liggitt
9e1064a26b Regenerate vendor 2022-05-04 10:27:41 -04:00
Elana Hashman
07af1bab70
deps: update runc to 1.1.0
This updates vendored runc/libcontainer to 1.1.0,
and google/cadvisor to a version updated to runc 1.1.0
(google/cadvisor#3048).

Changes in vendor are generated by (roughly):

        ./hack/pin-dependency.sh github.com/google/cadvisor v0.44.0
        ./hack/pin-dependency.sh github.com/opencontainers/runc v1.1.0
        ./hack/update-vendor.sh
        ./hack/lint-dependencies.sh # And follow all its recommendations.
        ./hack/update-vendor.sh
        ./hack/update-internal-modules.sh
        ./hack/lint-dependencies.sh # Re-check everything again.

Co-Authored-By: Kir Kolyshkin <kolyshkin@gmail.com>
2022-03-28 16:23:18 -07:00
Benjamin Elder
56e092e382 hack/update-bazel.sh 2021-02-28 15:17:29 -08:00
Davanum Srinivas
8d6848ada1
updating github.com/cyphar/filepath-securejoin to v0.2.2 2019-06-14 16:47:56 -04:00
Jeff Grafton
23ceebac22 Run hack/update-bazel.sh 2018-06-22 16:22:57 -07:00
Jeff Grafton
a725660640 Update to gazelle 0.12.0 and run hack/update-bazel.sh 2018-06-22 16:22:18 -07:00
vikaschoudhary16
4711bccd05 Bump runc to d5b4a3e
This fixes a race condition in runc/systemd at container creation time
opencontainers/runc#1683

Signed-off-by: vikaschoudhary16 <vichoudh@redhat.com>
2018-01-12 14:22:50 -05:00