Skip to content

[WIP] testing updated snapshotters#5663

Draft
thaJeztah wants to merge 3 commits intomoby:masterfrom
thaJeztah:update_snapshotters
Draft

[WIP] testing updated snapshotters#5663
thaJeztah wants to merge 3 commits intomoby:masterfrom
thaJeztah:update_snapshotters

Conversation

@github-actions github-actions bot added the area/dependencies Pull requests that update a dependency file label Jan 15, 2025
go.mod Outdated
module github.com/moby/buildkit

go 1.22.0
go 1.22.7
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

go.mod Outdated
Comment on lines +103 to +106
golang.org/x/sys v0.28.0
golang.org/x/sys v0.29.0
golang.org/x/time v0.6.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38
google.golang.org/grpc v1.68.1
google.golang.org/grpc v1.69.4
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like stargz has dependabot enabled, so aggressively updating to "latest"; containerd/stargz-snapshotter@0e94cae

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
golang.org/x/time v0.6.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38
google.golang.org/grpc v1.69.4
google.golang.org/genproto/googleapis/rpc v0.0.0-20241202173237-19429a94021a
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like this dependency was susceptible to GHA script injection (but no mention if it was exploited); googleapis/go-genproto@324edc3...19429a9

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants