Skip to content

Fix CVE-2024-25621: Upgrade containerd to v1.7.29 #181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
clyang82 merged 2 commits into from
Dec 13, 2025
Merged

Fix CVE-2024-25621: Upgrade containerd to v1.7.29 #181

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e565777
Fix CVE-2024-25621: Upgrade containerd to v1.7.29
clyang82 Dec 12, 2025
0b20a8e
Fix k8s.io dependency resolution for go work vendor
clyang82 Dec 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 34 additions & 16 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ go 1.25.3
// github.com/docker/docker@v0.0.0-00010101000000-000000000000: invalid version: unknown revision 000000000000
replace github.com/docker/docker => github.com/moby/moby v23.0.4+incompatible

// Override containerd to fix CVE-2024-25621 (local privilege escalation)
replace github.com/containerd/containerd => github.com/containerd/containerd v1.7.29

// contains openapi encoder fixes. remove ASAP
replace cuelang.org/go => github.com/grafana/cue v0.0.0-20230926092038-971951014e3f // @grafana/grafana-as-code

Expand All @@ -18,6 +21,22 @@ replace github.com/prometheus/prometheus => github.com/prometheus/prometheus v0.
// Update when github.com/deepmap/oapi-codegen/v2 is updated to support later versions.
replace github.com/getkin/kin-openapi => github.com/getkin/kin-openapi v0.122.0

// this is required until a new version of k8s.io/component-base is released
// with an update to prometheus/common v0.48.0
replace k8s.io/component-base => k8s.io/component-base v0.0.0-20240417101527-62c04b35eff6

// Replace k8s.io/apimachinery to resolve v0.0.0 dependency issue
replace k8s.io/apimachinery => k8s.io/apimachinery v0.29.3

// Replace k8s.io/client-go to resolve v0.0.0 dependency issue
replace k8s.io/client-go => k8s.io/client-go v0.29.3

// Replace k8s.io/api to resolve v0.0.0 dependency issue
replace k8s.io/api => k8s.io/api v0.29.3

// Replace k8s.io/apiserver to resolve v0.0.0 dependency issue
replace k8s.io/apiserver => k8s.io/apiserver v0.29.2

require (
buf.build/gen/go/parca-dev/parca/bufbuild/connect-go v1.4.1-20221222094228-8b1d3d0f62e6.1 // @grafana/observability-traces-and-profiling
buf.build/gen/go/parca-dev/parca/protocolbuffers/go v1.33.0-20240414232344-9ca06271cb73.1 // @grafana/observability-traces-and-profiling
Expand Down Expand Up @@ -61,7 +80,7 @@ require (
github.com/fullstorydev/grpchan v1.1.1 // @grafana/grafana-backend-group
github.com/gchaincl/sqlhooks v1.3.0 // @grafana/grafana-search-and-storage
github.com/getkin/kin-openapi v0.124.0 // @grafana/grafana-as-code
github.com/go-jose/go-jose/v3 v3.0.3 // @grafana/identity-access-team
github.com/go-jose/go-jose/v3 v3.0.4 // @grafana/identity-access-team
github.com/go-kit/log v0.2.1 // @grafana/grafana-backend-group
github.com/go-ldap/ldap/v3 v3.4.4 // @grafana/identity-access-team
github.com/go-openapi/loads v0.21.5 // @grafana/alerting-backend
Expand Down Expand Up @@ -174,19 +193,19 @@ require (
go.uber.org/atomic v1.11.0 // @grafana/alerting-backend
go.uber.org/goleak v1.3.0 // @grafana/grafana-search-and-storage
gocloud.dev v0.25.0 // @grafana/grafana-app-platform-squad
golang.org/x/crypto v0.35.0 // @grafana/grafana-backend-group
golang.org/x/crypto v0.40.0 // @grafana/grafana-backend-group
golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f // @grafana/alerting-backend
golang.org/x/mod v0.21.0 // @grafana/grafana-backend-group
golang.org/x/net v0.36.0 // @grafana/oss-big-tent @grafana/partner-datasources
golang.org/x/oauth2 v0.27.0 // @grafana/identity-access-team
golang.org/x/sync v0.11.0 // @grafana/alerting-backend
golang.org/x/text v0.22.0 // @grafana/grafana-backend-group
golang.org/x/time v0.5.0 // @grafana/grafana-backend-group
golang.org/x/tools v0.26.0 // @grafana/grafana-as-code
golang.org/x/mod v0.26.0 // @grafana/grafana-backend-group
golang.org/x/net v0.42.0 // @grafana/oss-big-tent @grafana/partner-datasources
golang.org/x/oauth2 v0.30.0 // @grafana/identity-access-team
golang.org/x/sync v0.16.0 // @grafana/alerting-backend
golang.org/x/text v0.27.0 // @grafana/grafana-backend-group
golang.org/x/time v0.12.0 // @grafana/grafana-backend-group
golang.org/x/tools v0.34.0 // @grafana/grafana-as-code
gonum.org/v1/gonum v0.12.0 // @grafana/observability-metrics
google.golang.org/api v0.176.0 // @grafana/grafana-backend-group
google.golang.org/grpc v1.64.0 // @grafana/plugins-platform-backend
google.golang.org/protobuf v1.34.1 // @grafana/plugins-platform-backend
google.golang.org/protobuf v1.35.2 // @grafana/plugins-platform-backend
gopkg.in/ini.v1 v1.67.0 // @grafana/alerting-backend
gopkg.in/mail.v2 v2.3.1 // @grafana/grafana-backend-group
gopkg.in/yaml.v3 v3.0.1 // @grafana/alerting-backend
Expand Down Expand Up @@ -228,7 +247,7 @@ require (
github.com/FZambia/eagle v0.1.0 // indirect
github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c // indirect
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/NYTimes/gziphandler v1.1.1 // indirect
github.com/RoaringBitmap/roaring v0.9.4 // indirect
github.com/agext/levenshtein v1.2.1 // indirect
Expand Down Expand Up @@ -290,9 +309,8 @@ require (
github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32 // indirect
github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
github.com/go-logfmt/logfmt v0.6.0 // indirect
github.com/go-logr/logr v1.4.1 // indirect; @grafana/grafana-app-platform-squad
github.com/go-logr/logr v1.4.2 // indirect; @grafana/grafana-app-platform-squad
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-openapi/analysis v0.22.2 // indirect
github.com/go-openapi/errors v0.22.0 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
Expand Down Expand Up @@ -382,7 +400,7 @@ require (
github.com/oklog/run v1.1.0 // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.0.3-0.20220512140940-7b36cea86235 // indirect
github.com/opencontainers/image-spec v1.1.0 // indirect
github.com/opentracing-contrib/go-stdlib v1.0.0 // indirect
github.com/opentracing/opentracing-go v1.2.0 // indirect
github.com/perimeterx/marshmallow v1.1.5 // indirect
Expand Down Expand Up @@ -434,8 +452,8 @@ require (
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.26.0 // indirect
golang.org/x/sys v0.30.0 // indirect
golang.org/x/term v0.29.0 // indirect
golang.org/x/sys v0.34.0 // indirect
golang.org/x/term v0.33.0 // indirect
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de // indirect; @grafana/grafana-backend-group
google.golang.org/genproto/googleapis/api v0.0.0-20240429193739-8cf5692501f6 // indirect
Expand Down
Loading