Skip to content

[release/2.0] Upgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63#11387

Merged
estesp merged 2 commits intocontainerd:release/2.0from
frcai:users/frcai/upgrade-x-net-33
Feb 18, 2025
Merged

[release/2.0] Upgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63#11387
estesp merged 2 commits intocontainerd:release/2.0from
frcai:users/frcai/upgrade-x-net-33

Conversation

@frcai
Copy link

@frcai frcai commented Feb 13, 2025

No description provided.

@k8s-ci-robot
Copy link

Hi @frcai. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@dosubot dosubot bot added the dependencies Pull requests that update a dependency file label Feb 13, 2025
@frcai frcai changed the title [release/2.0] Upgrade x/net to 0.33.0 [release/2.0] Upgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 Feb 14, 2025
@frcai frcai force-pushed the users/frcai/upgrade-x-net-33 branch from 310782e to b623e60 Compare February 14, 2025 00:39
@frcai frcai force-pushed the users/frcai/upgrade-x-net-33 branch 2 times, most recently from c956723 to f3b6010 Compare February 14, 2025 00:58
Signed-off-by: Chifeng Cai <frcai@microsoft.com>
@frcai frcai force-pushed the users/frcai/upgrade-x-net-33 branch from f3b6010 to d3437eb Compare February 14, 2025 01:01
Signed-off-by: Chifeng Cai <frcai@microsoft.com>
Copy link
Member

@AkihiroSuda AkihiroSuda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but it is unlikely that we are using the vulnerable HTML parser?

$ go mod why golang.org/x/net/html
# golang.org/x/net/html
github.com/containerd/containerd/v2/internal/cri/config
k8s.io/kubelet/pkg/cri/streaming
k8s.io/kubelet/pkg/cri/streaming/portforward
k8s.io/apimachinery/pkg/util/httpstream/spdy
k8s.io/apimachinery/pkg/util/proxy
golang.org/x/net/html

@frcai
Copy link
Author

frcai commented Feb 18, 2025

@kzys This PR needs another approval with write access, thanks.

@estesp estesp merged commit 6793199 into containerd:release/2.0 Feb 18, 2025
56 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file needs-ok-to-test size/XL

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

5 participants