Skip to content

chore(deps): bump the go_modules group across 1 directory with 6 updates - #446

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go_modules-cc601e0698
Open

chore(deps): bump the go_modules group across 1 directory with 6 updates#446
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go_modules-cc601e0698

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown

Bumps the go_modules group with 6 updates in the / directory:

Package From To
github.com/google/cel-go 0.27.0 0.29.0
google.golang.org/grpc 1.81.1 1.83.2
github.com/cilium/ebpf 0.21.0 0.22.0
github.com/containerd/containerd 1.7.32 1.7.35
github.com/moby/go-archive 0.2.0 0.3.0
oras.land/oras-go/v2 2.6.0 2.6.2

Updates github.com/google/cel-go from 0.27.0 to 0.29.0

Commits

Updates google.golang.org/grpc from 1.81.1 to 1.83.2

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.2

Security

  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

Release 1.83.1

Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

Performance

  • transport: Restrict memory overhead of buffering small data frames. (#9331)

Release 1.83.0

Security

  • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
  • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
  • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
  • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

  • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
  • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
  • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
  • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
  • xds: Add support for xDS-based HTTP CONNECT proxies.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
  • xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

  • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
  • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)

... (truncated)

Commits

Updates github.com/cilium/ebpf from 0.21.0 to 0.22.0

Release notes

Sourced from github.com/cilium/ebpf's releases.

v0.22.0: Linux 7.1 compat, BPF tokens and vmlinux BTF caching changes

Hi everyone! Today we announce the v0.22.0 release of ebpf-go. We ship Linux 7.1 compatibility, older versions of the library will not work on 7.1 kernels and above, so please upgrade if you are targeting the latest releases of Linux. We also made a breaking change to BTF caching, please read those notes. And of course a few fixes, improvements and minor features.

Kernel 7.1 compatibility

In kernel 7.1 the BTF header was extended to introduce a new feature called BTF layout. This change caused our BTF parser to fail when parsing vmlinux for this kernel. This has been fixed in this latest release, we recommend upgrading to this latest release to avoid breakage on 7.1 and newer kernels.

See cilium/ebpf#2042 for details. Special thanks to @​Capricornus007 for making the bug report that allowed us to fix this in a timely manner.

BPF token support

Some BPF-related actions require the user to have root privileges (CAP_SYS_ADMIN). One example is loading and attaching programs that can inspect kernel memory. In some environments, you may want to permit a known good process to load such BPF programs, but you don't want to grant it CAP_SYS_ADMIN to avoid privilege escalation if that process gets compromised.

BPF tokens are a mechanism that allows a privileged process to delegate fine-grained BPF capabilities to an unprivileged process. The process of delegating is complex and typically handled by a container runtime such as LXC or a process manager like systemd. This part of the handshake is currently out of scope of ebpf-go, as the library is not in charge of process creation where this delegation takes place.

However, the consuming side is what's included in this release. ebpf-go will automatically detect when the current process is running in a namespace where a BPF token is provided, and will automatically try to obtain an use it for interacting with the BPF syscall. Unlike libbpf, this currently requires no extra configuration on behalf of the application.

See cilium/ebpf#1953 for more details.

BTF cache changes

Package btf used to cache kernel (vmlinux) BTF specs globally. This is a significant time gain when loading multiple Collections in a row. However, doing so comes at a fairly significant memory cost (~20 MiB), so users could flush this cache with btf.FlushKernelSpec. Unfortunately, the caching behaviour being opt-out means users would typically discover it while investigating memory usage, and would then have to find an appropriate time during execution to call the flush function. This was always a band-aid for something we didn't have a clear solution to.

With this update, we've removed the global cache and the btf.FlushKernelSpec function, which may slow down subsequent collection loading on busy systems. To opt back in, users can now maintain their own cache object, obtained from btf.NewCache and pass it to NewCollectionWithOptions via CollectionOptions.Cache. Typically, you would put this in a global variable in a bpf-related package in your application, or keep it around in function scope if you load multiple collections in a row.

See cilium/ebpf#1988 for more details. Thank you @​matthyx for these changes.

New features

Bug fixes and improvements

... (truncated)

Commits
  • e55144e btf: Add BTF layout header parsing
  • d37ad9c struct_ops_test: Fix TestCreateStructOpsMapSpecSimple
  • 5e8bcc7 btf: Remove vmlinux dedup test
  • f1eb026 Update kernel dependencies to 7.1
  • 970a97d CODEOWNERS: allow reviewers to merge docs/, add rgo3 to link/
  • 7be98ef variable: reject offsets that overflow uint32 bounds
  • b404658 build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
  • 63647bc build(deps): bump mkdocs-git-revision-date-localized-plugin
  • e30ccb7 memory: use unsafe.Add to align unsafe memory instead of uintptr conversion
  • 0e35955 Makefile: pre-create GOCACHE, GOPATH and GOMODCACHE for podman
  • Additional commits viewable in compare view

Updates github.com/containerd/containerd from 1.7.32 to 1.7.35

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.35

Welcome to the v1.7.35 release of containerd!

The thirty-fifth patch release for containerd 1.7 contains various fixes and updates including security patches.

Security Updates

Highlights

Image Distribution

  • Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14046)

Runtime

  • Enable log scrubbing by default on Windows (#13889)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Samuel Karp
  • Oleh Konko
  • Chris Henzie
  • Maksym Pavlenko
  • Phil Estes
  • XlabAI

Changes

  • 05aa78da3 Prepare release notes for v1.7.35
  • 3bd79bb36 Merge commit from fork
  • 5a2a3a759 cri: cancel ExecSync IO drain on context cancellation
  • 323e148f2 Merge commit from fork
  • 9205b1903 archive: skip redundant opaque whiteout walks
  • docker fetcher: strip sensitive headers on descriptor URLs (#14046)
    • b01d66349 core/remotes/docker: normalize descriptor URL origins
    • b5d936dca core/remotes/docker: strip sensitive headers on desc.urls fetch
  • Use ScrubLogs by default on Windows (#13889)
    • cff94ea40 ctr: add --scrub-logs flag for Windows
    • 544e4657d cri/config: use ScrubLogs by default on Windows
  • ci: bound Go fuzzing by execution count (#13788)

... (truncated)

Commits
  • 0fab6e1 Merge pull request #14099 from samuelkarp/prepare-release-1.7.35
  • e5ae3c7 Prepare release notes for v1.7.35
  • 3bd79bb Merge commit from fork
  • 323e148 Merge commit from fork
  • 5a2a3a7 cri: cancel ExecSync IO drain on context cancellation
  • 9205b19 archive: skip redundant opaque whiteout walks
  • 994fd09 Merge pull request #14046 from samuelkarp/cherry-pick-12889-to-release/1.7
  • b01d663 core/remotes/docker: normalize descriptor URL origins
  • b5d936d core/remotes/docker: strip sensitive headers on desc.urls fetch
  • fd2d9b6 Merge pull request #13889 from samuelkarp/hcsshim-scrub-logs-1.7
  • Additional commits viewable in compare view

Updates github.com/moby/go-archive from 0.2.0 to 0.3.0

Release notes

Sourced from github.com/moby/go-archive's releases.

v0.3.0

Security

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

Test and CI changes

Full Changelog: moby/go-archive@v0.2.1...v0.3.0

v0.2.1

What's Changed

... (truncated)

Commits
  • 1c23372 Merge pull request #43 from thaJeztah/fix_rebase_from_root
  • 8829a25 RebaseArchiveEntries: fix archive path rebasing
  • c583b20 Merge pull request #90 from thaJeztah/chtimes_nofollow
  • a0576cb archive: do not follow reparse points in chtimes
  • b0d5baf archive: add test for unexpected reparse points in chtimes
  • c23e4e5 Merge pull request #79 from thaJeztah/test_chtimes
  • aa1541a archive: fix creation time updates on Windows
  • c68e60d archive: add Windows creation time test
  • a11565d Merge pull request #91 from thaJeztah/breakout_unwrap
  • b680a61 Merge pull request #89 from moby/dependabot/github_actions/codeql-actions-ba9...
  • Additional commits viewable in compare view

Updates oras.land/oras-go/v2 from 2.6.0 to 2.6.2

Release notes

Sourced from oras.land/oras-go/v2's releases.

v2.6.2

This is a security patch release addressing advisories in the content and remote layers, plus additional hardening and bug fixes since v2.6.1.

Security Fixes

  • Resolve the hardlink (TypeLink) target before passing it to os.Link, preventing a crafted OCI artifact from hardlinking a file outside the extraction directory via the process CWD (#1232, GHSA-fxhp-mv3v-67qp / CVE-2026-50163)
  • Bound tag and referrer list pagination to prevent a malicious or misbehaving registry from advertising an endless page chain and forcing unbounded client requests (client-side DoS) (#1215)

Bug Fixes

  • Bound content.ReadAll allocation by actual content read rather than the descriptor size, correcting the over-broad 32 MiB cap introduced for GHSA-f36w-mj3v-6jqv so legitimate in-memory Push/FetchAll/FetchBytes are not rejected (#1223)

Other Changes

  • Bump golang.org/x/sync from 0.20.0 to 0.21.0 (#1208)

v2.6.1

This is a security patch release addressing five advisories in the authentication, remote, and content layers, plus accumulated bug fixes and maintenance since v2.6.0.

Security Fixes

  • Drop the Authorization header on cross-origin redirects to prevent origin credentials leaking to a redirect target on a different scheme/port of the same host (GHSA-vh4v-2xq2-g5cg)
  • Validate the bearer realm host before sending credentials to prevent credential exfiltration to an attacker-controlled token service, including TLS downgrades and IP-literal metadata endpoints; adds TrustedRealmHosts (GHSA-28r5-37g7-p6mp, GHSA-xf85-363p-868w)
  • Validate the Location host before blob upload to prevent credentials being forwarded to a cross-host upload endpoint (SSRF / CWE-918) (#1152, GHSA-jxpm-75mh-9fp7)
  • Reject descriptor sizes exceeding 32 MiB in content.ReadAll to prevent a crafted OCI layout from triggering a makeslice panic and crashing the process (#1153, GHSA-f36w-mj3v-6jqv)
  • Resolve symlinks when enforcing the workingDir write boundary in content/file, blocking writes that escape the boundary via a symlinked path component when AllowPathTraversalOnWrite=false

Bug Fixes

  • graph.Memory should use digest as map key (#1095)
  • Fix credentials key for the Docker registry-1 host (#966)
  • Support an empty credentials file (#959)

Other Changes

  • Add GitOps release workflow with goreleaser (#1161)
  • Shift the Go support window to [1.24, 1.25] (#991)
  • Run go modernize (#1005)
  • Sync CODEOWNERS and OWNERS.md from main to v2 (#1122)
  • Remove scripts reference from the Makefile (#960)
  • Bump golang.org/x/sync 0.14.0 → 0.20.0 (#971, #978, #1001, #1037, #1078, #1121)
  • Bump GitHub Actions: actions/checkout 4→5 (#989), actions/setup-go 5→6 (#998), actions/stale 9→10 (#997), github/codeql-action 3→4 (#1016)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the go_modules group across 1 directory with 6 updates
e0cbeb9 
Bumps the go_modules group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/google/cel-go](https://github.com/google/cel-go) | `0.27.0` | `0.29.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.81.1` | `1.83.2` |
| [github.com/cilium/ebpf](https://github.com/cilium/ebpf) | `0.21.0` | `0.22.0` |
| [github.com/containerd/containerd](https://github.com/containerd/containerd) | `1.7.32` | `1.7.35` |
| [github.com/moby/go-archive](https://github.com/moby/go-archive) | `0.2.0` | `0.3.0` |
| [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) | `2.6.0` | `2.6.2` |



Updates `github.com/google/cel-go` from 0.27.0 to 0.29.0
- [Commits](https://github.com/google/cel-go/commits)

Updates `google.golang.org/grpc` from 1.81.1 to 1.83.2
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.81.1...v1.83.2)

Updates `github.com/cilium/ebpf` from 0.21.0 to 0.22.0
- [Release notes](https://github.com/cilium/ebpf/releases)
- [Commits](cilium/ebpf@v0.21.0...v0.22.0)

Updates `github.com/containerd/containerd` from 1.7.32 to 1.7.35
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v1.7.32...v1.7.35)

Updates `github.com/moby/go-archive` from 0.2.0 to 0.3.0
- [Release notes](https://github.com/moby/go-archive/releases)
- [Changelog](https://github.com/moby/go-archive/blob/main/changes_test.go)
- [Commits](moby/go-archive@v0.2.0...v0.3.0)

Updates `oras.land/oras-go/v2` from 2.6.0 to 2.6.2
- [Release notes](https://github.com/oras-project/oras-go/releases)
- [Changelog](https://github.com/oras-project/oras-go/blob/main/RELEASES.md)
- [Commits](oras-project/oras-go@v2.6.0...v2.6.2)

---
updated-dependencies:
- dependency-name: github.com/google/cel-go
  dependency-version: 0.29.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/cilium/ebpf
  dependency-version: 0.22.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/containerd/containerd
  dependency-version: 1.7.35
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/moby/go-archive
  dependency-version: 0.3.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: oras.land/oras-go/v2
  dependency-version: 2.6.2
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants