diff --git a/go.mod b/go.mod index d98590426e..a1bf8f3dc9 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/Masterminds/semver/v3 v3.5.0 github.com/blang/semver/v4 v4.0.0 github.com/cert-manager/cert-manager v1.21.1 - github.com/containerd/containerd v1.7.34 + github.com/containerd/containerd v1.7.35 github.com/cucumber/gherkin/go/v26 v26.2.0 github.com/cucumber/godog v0.16.0 github.com/cucumber/messages/go/v21 v21.0.1 @@ -16,7 +16,7 @@ require ( github.com/go-logr/logr v1.4.4 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-cmp v0.7.0 - github.com/google/go-containerregistry v0.21.9 + github.com/google/go-containerregistry v0.22.0 github.com/google/renameio/v2 v2.0.2 github.com/gorilla/handlers v1.5.2 github.com/graphql-go/graphql v0.8.1 @@ -94,7 +94,7 @@ require ( github.com/cyphar/filepath-securejoin v0.7.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/distribution/reference v0.6.0 // indirect - github.com/docker/cli v29.7.1+incompatible // indirect + github.com/docker/cli v29.7.2+incompatible // indirect github.com/docker/distribution v2.8.3+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.8 // indirect github.com/docker/go-connections v0.8.1 // indirect @@ -241,7 +241,7 @@ require ( google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect - google.golang.org/grpc v1.83.1 // indirect + google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index 68ab4fe3ba..bb81907334 100644 --- a/go.sum +++ b/go.sum @@ -64,8 +64,8 @@ github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJ github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= github.com/containerd/cgroups/v3 v3.1.2 h1:OSosXMtkhI6Qove637tg1XgK4q+DhR0mX8Wi8EhrHa4= github.com/containerd/cgroups/v3 v3.1.2/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw= -github.com/containerd/containerd v1.7.34 h1:Q35B4FUECxcoaMz9QrOlqp+0s72w8/0NWawVMhVdf5g= -github.com/containerd/containerd v1.7.34/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= +github.com/containerd/containerd v1.7.35 h1:7AU2T1qI2OdNBmKkreWZ7kASHUNFItN5Hgejd9sY938= +github.com/containerd/containerd v1.7.35/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= github.com/containerd/containerd/api v1.10.0 h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o= github.com/containerd/containerd/api v1.10.0/go.mod h1:NBm1OAk8ZL+LG8R0ceObGxT5hbUYj7CzTmR3xh0DlMM= github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4= @@ -119,8 +119,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI= github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= -github.com/docker/cli v29.7.1+incompatible h1:ILZpP6B7fedIr6ANy824QkDp1WMJuouIq0O2SrBkB2w= -github.com/docker/cli v29.7.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.7.2+incompatible h1:dlkwallR8XqfeVnA2ELEhdwvb4lsSwuB4IgsG8Q9cLY= +github.com/docker/cli v29.7.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q= @@ -261,8 +261,8 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.9 h1:F+D4uZ3iA3DLMJLfhaqMdHJbzeqm/216WGQq2dokuLs= -github.com/google/go-containerregistry v0.21.9/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= +github.com/google/go-containerregistry v0.22.0 h1:eGbCiPeYxAH/7WLLq6zTBALP0tUIFsoyRauhxXDJ53I= +github.com/google/go-containerregistry v0.22.0/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= @@ -738,8 +738,8 @@ google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyac google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc= -google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= -google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= diff --git a/openshift/tests-extension/go.mod b/openshift/tests-extension/go.mod index f9a67d1f65..094b2d96be 100644 --- a/openshift/tests-extension/go.mod +++ b/openshift/tests-extension/go.mod @@ -108,7 +108,7 @@ require ( golang.org/x/tools v0.49.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect - google.golang.org/grpc v1.83.1 // indirect + google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/openshift/tests-extension/go.sum b/openshift/tests-extension/go.sum index 7b63c9b0c1..2a2f19ead5 100644 --- a/openshift/tests-extension/go.sum +++ b/openshift/tests-extension/go.sum @@ -284,8 +284,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1: google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY= google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad h1:45WmJvIV6C2+O/jjLkPUH+F3aOj/1miDoU2DD0+NWbg= google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= -google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/openshift/tests-extension/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/openshift/tests-extension/vendor/google.golang.org/grpc/internal/transport/http2_server.go index 63c6539a3d..82e13e64aa 100644 --- a/openshift/tests-extension/vendor/google.golang.org/grpc/internal/transport/http2_server.go +++ b/openshift/tests-extension/vendor/google.golang.org/grpc/internal/transport/http2_server.go @@ -522,6 +522,12 @@ func (t *http2Server) operateHeaders(ctx context.Context, frame *http2.MetaHeade delete(mdata, "host") } + // If :authority is still missing, i.e. no host or :authority header is + // present, reject the request as invalid. + if len(mdata[":authority"]) == 0 { + t.writeEarlyAbort(streamID, s.contentSubtype, status.New(codes.Internal, "no host or :authority header present"), http.StatusBadRequest, !frame.StreamEnded()) + return nil + } if frame.StreamEnded() { // s is just created by the caller. No lock needed. s.state = streamReadDone diff --git a/openshift/tests-extension/vendor/google.golang.org/grpc/version.go b/openshift/tests-extension/vendor/google.golang.org/grpc/version.go index 64ec3b3cfd..835dc07fdc 100644 --- a/openshift/tests-extension/vendor/google.golang.org/grpc/version.go +++ b/openshift/tests-extension/vendor/google.golang.org/grpc/version.go @@ -19,4 +19,4 @@ package grpc // Version is the current grpc version. -const Version = "1.83.1" +const Version = "1.83.2" diff --git a/openshift/tests-extension/vendor/modules.txt b/openshift/tests-extension/vendor/modules.txt index 601b0e7ce3..b6513387a2 100644 --- a/openshift/tests-extension/vendor/modules.txt +++ b/openshift/tests-extension/vendor/modules.txt @@ -513,7 +513,7 @@ google.golang.org/genproto/googleapis/api/httpbody ## explicit; go 1.25.0 google.golang.org/genproto/googleapis/rpc/errdetails google.golang.org/genproto/googleapis/rpc/status -# google.golang.org/grpc v1.83.1 +# google.golang.org/grpc v1.83.2 ## explicit; go 1.25.0 google.golang.org/grpc google.golang.org/grpc/attributes diff --git a/requirements.txt b/requirements.txt index 5aabd1e173..6313560e81 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,7 +2,7 @@ Babel==2.18.0 beautifulsoup4==4.15.0 certifi==2026.7.22 charset-normalizer==3.5.1 -click==8.4.2 +click==8.5.0 colorama==0.4.6 cssselect==1.5.0 ghp-import==2.1.0 @@ -19,7 +19,7 @@ mkdocs-material-extensions==1.3.1 packaging==26.3 paginate==0.5.7 pathspec==1.1.1 -platformdirs==4.11.3 +platformdirs==4.11.5 Pygments==2.21.0 pymdown-extensions==11.0.2 pyquery==2.1.0 diff --git a/vendor/github.com/containerd/containerd/archive/tar.go b/vendor/github.com/containerd/containerd/archive/tar.go index 21ab7f8114..b96a4125a9 100644 --- a/vendor/github.com/containerd/containerd/archive/tar.go +++ b/vendor/github.com/containerd/containerd/archive/tar.go @@ -169,6 +169,9 @@ func applyNaive(ctx context.Context, root string, r io.Reader, options ApplyOpti // Used for handling opaque directory markers which // may occur out of order unpackedPaths = make(map[string]struct{}) + // Used for tracking directories that have already processed an + // opaque directory marker to avoid redundant directory walks + opaqueDirs = make(map[string]struct{}) convertWhiteout = options.ConvertWhiteout ) @@ -179,6 +182,11 @@ func applyNaive(ctx context.Context, root string, r io.Reader, options ApplyOpti base := filepath.Base(path) dir := filepath.Dir(path) if base == whiteoutOpaqueDir { + if _, ok := opaqueDirs[dir]; ok { + return false, nil + } + opaqueDirs[dir] = struct{}{} + _, err := os.Lstat(dir) if err != nil { return false, err @@ -195,7 +203,12 @@ func applyNaive(ctx context.Context, root string, r io.Reader, options ApplyOpti } if _, exists := unpackedPaths[path]; !exists { err := os.RemoveAll(path) - return err + if err != nil { + return err + } + if info.IsDir() { + return filepath.SkipDir + } } return nil }) diff --git a/vendor/github.com/containerd/containerd/remotes/docker/fetcher.go b/vendor/github.com/containerd/containerd/remotes/docker/fetcher.go index c4c401ad1d..7c55883875 100644 --- a/vendor/github.com/containerd/containerd/remotes/docker/fetcher.go +++ b/vendor/github.com/containerd/containerd/remotes/docker/fetcher.go @@ -38,6 +38,40 @@ type dockerFetcher struct { *dockerBase } +func stripSensitiveHeadersForExternalURLs(h http.Header) { + h.Del("Authorization") + h.Del("Proxy-Authorization") + h.Del("Cookie") + h.Del("Cookie2") +} + +func effectivePort(u *url.URL) string { + if port := u.Port(); port != "" { + return port + } + switch strings.ToLower(u.Scheme) { + case "http": + return "80" + case "https": + return "443" + default: + return "" + } +} + +func isRegistryOrigin(u *url.URL, hosts []RegistryHost) bool { + for _, host := range hosts { + if !strings.EqualFold(u.Scheme, host.Scheme) { + continue + } + hostURL := &url.URL{Scheme: host.Scheme, Host: host.Host} + if strings.EqualFold(u.Hostname(), hostURL.Hostname()) && effectivePort(u) == effectivePort(hostURL) { + return true + } + } + return false +} + func (r dockerFetcher) Fetch(ctx context.Context, desc ocispec.Descriptor) (io.ReadCloser, error) { ctx = log.WithLogger(ctx, log.G(ctx).WithField("digest", desc.Digest)) @@ -75,6 +109,9 @@ func (r dockerFetcher) Fetch(ctx context.Context, desc ocispec.Descriptor) (io.R Capabilities: HostCapabilityPull, } req := r.request(host, http.MethodGet) + if !isRegistryOrigin(u, hosts) { + stripSensitiveHeadersForExternalURLs(req.header) + } // Strip namespace from base req.path = u.Path if u.RawQuery != "" { diff --git a/vendor/github.com/containerd/containerd/version/version.go b/vendor/github.com/containerd/containerd/version/version.go index c4007b0d06..a9ad4c4f11 100644 --- a/vendor/github.com/containerd/containerd/version/version.go +++ b/vendor/github.com/containerd/containerd/version/version.go @@ -23,7 +23,7 @@ var ( Package = "github.com/containerd/containerd" // Version holds the complete version number. Filled in at linking time. - Version = "1.7.34+unknown" + Version = "1.7.35+unknown" // Revision is filled with the VCS (e.g. git) revision being used to build // the program at linking time. diff --git a/vendor/github.com/google/go-containerregistry/pkg/name/repository.go b/vendor/github.com/google/go-containerregistry/pkg/name/repository.go index efde6e869d..ad7b329111 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/name/repository.go +++ b/vendor/github.com/google/go-containerregistry/pkg/name/repository.go @@ -72,7 +72,7 @@ func (r Repository) Scope(action string) string { } func checkRepository(repository string) error { - return checkElement("repository", repository, repositoryChars, 2, 255) + return checkElement("repository", repository, repositoryChars, 1, 255) } // NewRepository returns a new Repository representing the given name, according to the given strictness. diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go index 596c78cb26..0125bfc653 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go @@ -26,7 +26,6 @@ import ( "strings" "time" - "github.com/google/go-containerregistry/internal/gzip" v1 "github.com/google/go-containerregistry/pkg/v1" "github.com/google/go-containerregistry/pkg/v1/empty" "github.com/google/go-containerregistry/pkg/v1/match" @@ -469,7 +468,8 @@ func hasWindowsDrivePrefix(name string) bool { } // Time sets all timestamps in an image to the given timestamp. -func Time(img v1.Image, t time.Time) (v1.Image, error) { +// Layers are rewritten as dockerv2+gzip unless opts say otherwise. +func Time(img v1.Image, t time.Time, opts ...tarball.LayerOption) (v1.Image, error) { newImage := empty.Image layers, err := img.Layers() @@ -485,7 +485,7 @@ func Time(img v1.Image, t time.Time) (v1.Image, error) { addendums := make([]Addendum, max(len(ocf.History), len(layers))) var historyIdx, addendumIdx int for layerIdx := 0; layerIdx < len(layers); addendumIdx, layerIdx = addendumIdx+1, layerIdx+1 { - newLayer, err := layerTime(layers[layerIdx], t) + newLayer, err := layerTime(layers[layerIdx], t, opts...) if err != nil { return nil, fmt.Errorf("setting layer times: %w", err) } @@ -547,7 +547,7 @@ func Time(img v1.Image, t time.Time) (v1.Image, error) { return ConfigFile(newImage, cfg) } -func layerTime(layer v1.Layer, t time.Time) (v1.Layer, error) { +func layerTime(layer v1.Layer, t time.Time, opts ...tarball.LayerOption) (v1.Layer, error) { layerReader, err := layer.Uncompressed() if err != nil { return nil, fmt.Errorf("getting layer: %w", err) @@ -598,11 +598,10 @@ func layerTime(layer v1.Layer, t time.Time) (v1.Layer, error) { } b := w.Bytes() - // gzip the contents, then create the layer opener := func() (io.ReadCloser, error) { - return gzip.ReadCloser(io.NopCloser(bytes.NewReader(b))), nil + return io.NopCloser(bytes.NewReader(b)), nil } - layer, err = tarball.LayerFromOpener(opener) + layer, err = tarball.LayerFromOpener(opener, opts...) if err != nil { return nil, fmt.Errorf("creating layer: %w", err) } @@ -612,10 +611,10 @@ func layerTime(layer v1.Layer, t time.Time) (v1.Layer, error) { // Canonical is a helper function to combine Time and configFile // to remove any randomness during a docker build. -func Canonical(img v1.Image) (v1.Image, error) { +func Canonical(img v1.Image, opts ...tarball.LayerOption) (v1.Image, error) { // Set all timestamps to 0 created := time.Time{} - img, err := Time(img, created) + img, err := Time(img, created, opts...) if err != nil { return nil, err } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go index ac879a6737..8f5bd12633 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go @@ -32,9 +32,9 @@ import ( // // TODO(#412): Remove the need for this method. func CheckPushPermission(ref name.Reference, kc authn.Keychain, t http.RoundTripper) error { - auth, err := kc.Resolve(ref.Context().Registry) + auth, err := authn.Resolve(context.TODO(), kc, ref.Context()) if err != nil { - return fmt.Errorf("resolving authorization for %v failed: %w", ref.Context().Registry, err) + return fmt.Errorf("resolving authorization for %v failed: %w", ref.Context(), err) } scopes := []string{ref.Scope(transport.PushScope)} diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go index bcb0d7350f..094162ec44 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go @@ -76,7 +76,11 @@ func (p *Puller) fetcher(ctx context.Context, target resource) (*fetcher, error) o: p.o, }) rr := v.(*reader) - return rr.f, rr.init(ctx) + if err := rr.init(ctx); err != nil { + p.readers.CompareAndDelete(target, rr) + return nil, err + } + return rr.f, nil } // Head is like remote.Head, but avoids re-authenticating when possible. diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go index 3a1d16f544..3466c7a671 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/pusher.go @@ -122,7 +122,11 @@ func (p *Pusher) writer(ctx context.Context, repo name.Repository, o *options) ( o: o, }) rw := v.(*repoWriter) - return rw, rw.init(ctx) + if err := rw.init(ctx); err != nil { + p.writers.CompareAndDelete(repo, rw) + return nil, err + } + return rw, nil } func (p *Pusher) Put(ctx context.Context, ref name.Reference, t Taggable) error { diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/vendor/google.golang.org/grpc/internal/transport/http2_server.go index 63c6539a3d..82e13e64aa 100644 --- a/vendor/google.golang.org/grpc/internal/transport/http2_server.go +++ b/vendor/google.golang.org/grpc/internal/transport/http2_server.go @@ -522,6 +522,12 @@ func (t *http2Server) operateHeaders(ctx context.Context, frame *http2.MetaHeade delete(mdata, "host") } + // If :authority is still missing, i.e. no host or :authority header is + // present, reject the request as invalid. + if len(mdata[":authority"]) == 0 { + t.writeEarlyAbort(streamID, s.contentSubtype, status.New(codes.Internal, "no host or :authority header present"), http.StatusBadRequest, !frame.StreamEnded()) + return nil + } if frame.StreamEnded() { // s is just created by the caller. No lock needed. s.state = streamReadDone diff --git a/vendor/google.golang.org/grpc/version.go b/vendor/google.golang.org/grpc/version.go index 64ec3b3cfd..835dc07fdc 100644 --- a/vendor/google.golang.org/grpc/version.go +++ b/vendor/google.golang.org/grpc/version.go @@ -19,4 +19,4 @@ package grpc // Version is the current grpc version. -const Version = "1.83.1" +const Version = "1.83.2" diff --git a/vendor/modules.txt b/vendor/modules.txt index 5e409f969d..bc491969fa 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -155,7 +155,7 @@ github.com/cloudflare/circl/sign/ed448 # github.com/containerd/cgroups/v3 v3.1.2 ## explicit; go 1.22.0 github.com/containerd/cgroups/v3/cgroup1/stats -# github.com/containerd/containerd v1.7.34 +# github.com/containerd/containerd v1.7.35 ## explicit; go 1.25.0 github.com/containerd/containerd/archive github.com/containerd/containerd/archive/compression @@ -281,7 +281,7 @@ github.com/davecgh/go-spew/spew # github.com/distribution/reference v0.6.0 ## explicit; go 1.20 github.com/distribution/reference -# github.com/docker/cli v29.7.1+incompatible +# github.com/docker/cli v29.7.2+incompatible ## explicit github.com/docker/cli/cli/config github.com/docker/cli/cli/config/configfile @@ -478,7 +478,7 @@ github.com/google/go-cmp/cmp/internal/diff github.com/google/go-cmp/cmp/internal/flags github.com/google/go-cmp/cmp/internal/function github.com/google/go-cmp/cmp/internal/value -# github.com/google/go-containerregistry v0.21.9 +# github.com/google/go-containerregistry v0.22.0 ## explicit; go 1.25.0 github.com/google/go-containerregistry/internal/and github.com/google/go-containerregistry/internal/compression @@ -1201,7 +1201,7 @@ google.golang.org/genproto/googleapis/api/httpbody ## explicit; go 1.25.0 google.golang.org/genproto/googleapis/rpc/errdetails google.golang.org/genproto/googleapis/rpc/status -# google.golang.org/grpc v1.83.1 +# google.golang.org/grpc v1.83.2 ## explicit; go 1.25.0 google.golang.org/grpc google.golang.org/grpc/attributes