containerd

17,231 Commits 32 Branches 333 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Phil Estes	8d32443320	Update CI to include Go 1.27 Go 1.27 has been released and we can re-enable matrix building with min and max Go versions as well as move most of CI jobs to use the latest Go 1.27. Leave install-go action at 1.26.6. Signed-off-by: Phil Estes <estesp@amazon.com>	2026-08-25 10:03:38 -04:00
Paweł Gronowski	b665fde220	Update Go to 1.26.6 This release includes 10 security fixes covering module checksum verification, denial-of-service protections, parser crashes, XSS, and IDNA hostname validation, most notably: - CVE-2026-56865: prevent malicious GOPROXY servers from bypassing sumdb transparency-log verification: https://go.dev/issue/80744 - CVE-2026-56864: prevent malicious GOSUMDB servers from serving unauthenticated module content: https://go.dev/issue/80745 - CVE-2026-56859: add recursion limits for XML decoding: https://go.dev/issue/80481 - CVE-2026-56853: apply ReadHeaderTimeout during unencrypted HTTP/2 detection: https://go.dev/issue/80205 - CVE-2026-56860: prevent quadratic behavior in URL path resolution: https://go.dev/issue/80494 - CVE-2026-46600: prevent panics when parsing malformed SVCB/HTTPS DNS records: https://go.dev/issue/79795 - CVE-2026-56862: limit excessive TLS post-handshake messages: https://go.dev/issue/80528 - CVE-2026-56858: fix JavaScript regexp context tracking in html/template: https://go.dev/issue/80435 - CVE-2026-39821: reject invalid ASCII-only Punycode labels: https://go.dev/issue/78760 - CVE-2026-33818: add recursion limits for ASN.1 unmarshalling: https://go.dev/issue/80405 Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>	2026-08-13 22:13:25 +02:00
Akihiro Suda	a42b09aaa6	CI: migrate Vagrant to Lima Vagrant is no longer well maintained: e.g., its apt repository does not provide packages for Ubuntu 26.04 (hashicorp/vagrant#13811), and recent Fedora boxes are no longer published to HashiCorp's registry, so the CI had to download the box file manually from Fedora mirrors. The test scripts in the Vagrantfile were split out to script/vm/*.sh . The scripts depend on neither Vagrant nor Lima, and can be used with other VM environments too. Assisted-by: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	2026-07-08 21:09:27 +09:00

Author

SHA1

Message

Date

Phil Estes

8d32443320

Update CI to include Go 1.27

Go 1.27 has been released and we can re-enable matrix
building with min and max Go versions as well as move
most of CI jobs to use the latest Go 1.27. Leave install-go
action at 1.26.6.

Signed-off-by: Phil Estes <estesp@amazon.com>

2026-08-25 10:03:38 -04:00

Paweł Gronowski

b665fde220

Update Go to 1.26.6

This release includes 10 security fixes covering module checksum
verification, denial-of-service protections, parser crashes, XSS, and
IDNA hostname validation, most notably:

- CVE-2026-56865: prevent malicious GOPROXY servers from bypassing sumdb transparency-log verification: https://go.dev/issue/80744
- CVE-2026-56864: prevent malicious GOSUMDB servers from serving unauthenticated module content: https://go.dev/issue/80745
- CVE-2026-56859: add recursion limits for XML decoding: https://go.dev/issue/80481
- CVE-2026-56853: apply ReadHeaderTimeout during unencrypted HTTP/2 detection: https://go.dev/issue/80205
- CVE-2026-56860: prevent quadratic behavior in URL path resolution: https://go.dev/issue/80494
- CVE-2026-46600: prevent panics when parsing malformed SVCB/HTTPS DNS records: https://go.dev/issue/79795
- CVE-2026-56862: limit excessive TLS post-handshake messages: https://go.dev/issue/80528
- CVE-2026-56858: fix JavaScript regexp context tracking in html/template: https://go.dev/issue/80435
- CVE-2026-39821: reject invalid ASCII-only Punycode labels: https://go.dev/issue/78760
- CVE-2026-33818: add recursion limits for ASN.1 unmarshalling: https://go.dev/issue/80405

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

2026-08-13 22:13:25 +02:00

Akihiro Suda

a42b09aaa6

CI: migrate Vagrant to Lima

Vagrant is no longer well maintained: e.g., its apt repository does not
provide packages for Ubuntu 26.04 (hashicorp/vagrant#13811), and recent
Fedora boxes are no longer published to HashiCorp's registry, so the CI
had to download the box file manually from Fedora mirrors.

The test scripts in the Vagrantfile were split out to script/vm/*.sh .
The scripts depend on neither Vagrant nor Lima, and can be used with
other VM environments too.

Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

2026-07-08 21:09:27 +09:00