[release/1.7] vendor: github.com/go-jose/go-jose/v3 v3.0.4#11619
[release/1.7] vendor: github.com/go-jose/go-jose/v3 v3.0.4#11619AkihiroSuda merged 1 commit intocontainerd:release/1.7from
Conversation
|
Hi @swagatbora90. Thanks for your PR. I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Signed-off-by: Swagat Bora <sbora@amazon.com>
0ae6d29 to
52dd4dc
Compare
|
/retest |
|
@swagatbora90: Cannot trigger testing until a trusted user reviews the PR and leaves an DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/ok-to-test |
Updates the indirect dependency of go-jose to v3.0.4.
This update is mainly to silence the scanners for CVE-2025-27144, although containerd itself is not affected.
go-jose/v3is a dependency ofgithub.com/containers/ocicryptwhich is a dependency ofgithub.com/containerd/imgcrypt. Directly updatingimgcryptalso updates min go version to 1.23.0 and also moves togo-jose/v4, which seemed like a larger change than just updating the dependency directly.