build(deps): update all dependencies updates #1238
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1238 +/- ##
==========================================
+ Coverage 74.10% 74.19% +0.09%
==========================================
Files 30 30
Lines 3306 3306
==========================================
+ Hits 2450 2453 +3
+ Misses 690 688 -2
+ Partials 166 165 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
viccuad
approved these changes
Nov 10, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3.6.0->v3.7.0v1.3.2->v1.3.3v0.39.0->v0.40.01.25.3->1.25.4v4.5.13->v4.5.15v0.22.3->v0.22.4Release Notes
docker/setup-qemu-action (docker/setup-qemu-action)
v3.7.0Compare Source
Full Changelog: docker/setup-qemu-action@v3.6.0...v3.7.0
opencontainers/runc (github.com/opencontainers/runc)
v1.3.3: runc v1.3.3 -- "奴らに支配されていた恐怖を"Compare Source
This release contains fixes for three high-severity security
vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, and
CVE-2025-52881). All three vulnerabilities ultimately allow (through
different methods) for full container breakouts by bypassing runc's
restrictions for writing to arbitrary
/procfiles.Security
CVE-2025-31133 exploits an issue with how masked paths are implemented in
runc. When masking files, runc will bind-mount the container's
/dev/nullinode on top of the file. However, if an attacker can replace
/dev/nullwith a symlink to some other procfs file, runc will instead bind-mount the
symlink target read-write. This issue affected all known runc versions.
CVE-2025-52565 is very similar in concept and application to
CVE-2025-31133, except that it exploits a flaw in
/dev/consolebind-mounts. When creating the
/dev/consolebind-mount (to/dev/pts/$n),if an attacker replaces
/dev/pts/$nwith a symlink then runc willbind-mount the symlink target over
/dev/console. This issue affected allversions of runc >= 1.0.0-rc3.
CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921,
which was a flaw that allowed an attacker to trick runc into writing the LSM
process labels for a container process into a dummy tmpfs file and thus not
apply the correct LSM labels to the container process. The mitigation we
applied for CVE-2019-19921 was fairly limited and effectively only caused
runc to verify that when we write LSM labels that those labels are actual
procfs files. This issue affects all known runc versions.
Added
runc updatenow supports configuring per-device weights and iops. (#4775,#4807, #4825, #4931)
Static Linking Notices
The
runcbinary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runcactingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to the following contributors for making this release possible:
Signed-off-by: Aleksa Sarai [email protected]
testcontainers/testcontainers-go (github.com/testcontainers/testcontainers-go/modules/k3s)
v0.40.0Compare Source
What's Changed
The below modules receive a breaking change in the signature of their functional options, as now all of them return an error when needed (returning nil for success). Therefore, you're only affected when assigning the options to variables.
🚀 Features
🐛 Bug Fixes
📖 Documentation
🧹 Housekeeping
📦 Dependency updates
golang/go (go)
v1.25.4kubewarden/github-actions (kubewarden/github-actions)
v4.5.15Compare Source
🧰 Maintenance
v4.5.14Compare Source
🐛 Bug Fixes
kubernetes-sigs/controller-runtime (sigs.k8s.io/controller-runtime)
v0.22.4Compare Source
What's Changed
Full Changelog: kubernetes-sigs/controller-runtime@v0.22.3...v0.22.4
Configuration
📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.