Commit 019eb74
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
fix(security): Resolve CVE-GHSA-cgrx-mc8f-2prm by upgrading selinux to v1.13.0 (#2476)
* build(deps): bump @octokit/plugin-paginate-rest, @actions/github and @octokit/rest (#2338)
Bumps [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js) to 9.2.2 and updates ancestor dependencies [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js), [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) and [@octokit/rest](https://github.com/octokit/rest.js). These dependencies need to be updated together.
Updates `@octokit/plugin-paginate-rest` from 2.2.3 to 9.2.2
- [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases)
- [Commits](octokit/plugin-paginate-rest.js@v2.2.3...v9.2.2)
Updates `@actions/github` from 4.0.0 to 6.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github)
Updates `@octokit/rest` from 18.0.0 to 21.1.1
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](octokit/rest.js@v18.0.0...v21.1.1)
---
updated-dependencies:
- dependency-name: "@octokit/plugin-paginate-rest"
dependency-type: indirect
- dependency-name: "@actions/github"
dependency-type: direct:production
- dependency-name: "@octokit/rest"
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* build(deps): bump @octokit/request, @actions/github and @octokit/rest (#2370)
Bumps [@octokit/request](https://github.com/octokit/request.js) to 8.4.1 and updates ancestor dependencies [@octokit/request](https://github.com/octokit/request.js), [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) and [@octokit/rest](https://github.com/octokit/rest.js). These dependencies need to be updated together.
Updates `@octokit/request` from 5.6.3 to 8.4.1
- [Release notes](https://github.com/octokit/request.js/releases)
- [Commits](octokit/request.js@v5.6.3...v8.4.1)
Updates `@actions/github` from 4.0.0 to 6.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github)
Updates `@octokit/rest` from 18.0.0 to 21.1.1
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](octokit/rest.js@v18.0.0...v21.1.1)
---
updated-dependencies:
- dependency-name: "@octokit/request"
dependency-version: 8.4.1
dependency-type: indirect
- dependency-name: "@actions/github"
dependency-version: 6.0.0
dependency-type: direct:production
- dependency-name: "@octokit/rest"
dependency-version: 21.1.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* build(deps): bump the go-dependencies group with 8 updates (#2453)
Bumps the go-dependencies group with 8 updates:
| Package | From | To |
| --- | --- | --- |
| [github.com/docker/cli](https://github.com/docker/cli) | `28.5.0+incompatible` | `28.5.1+incompatible` |
| [github.com/docker/docker](https://github.com/docker/docker) | `28.5.0+incompatible` | `28.5.1+incompatible` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.42.0` | `0.43.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.28.0` | `0.29.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.31.0` | `0.32.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.36.0` | `0.37.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.35.0` | `0.36.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.29.0` | `0.30.0` |
Updates `github.com/docker/cli` from 28.5.0+incompatible to 28.5.1+incompatible
- [Commits](docker/cli@v28.5.0...v28.5.1)
Updates `github.com/docker/docker` from 28.5.0+incompatible to 28.5.1+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v28.5.0...v28.5.1)
Updates `golang.org/x/crypto` from 0.42.0 to 0.43.0
- [Commits](golang/crypto@v0.42.0...v0.43.0)
Updates `golang.org/x/mod` from 0.28.0 to 0.29.0
- [Commits](golang/mod@v0.28.0...v0.29.0)
Updates `golang.org/x/oauth2` from 0.31.0 to 0.32.0
- [Commits](golang/oauth2@v0.31.0...v0.32.0)
Updates `golang.org/x/sys` from 0.36.0 to 0.37.0
- [Commits](golang/sys@v0.36.0...v0.37.0)
Updates `golang.org/x/term` from 0.35.0 to 0.36.0
- [Commits](golang/term@v0.35.0...v0.36.0)
Updates `golang.org/x/text` from 0.29.0 to 0.30.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.29.0...v0.30.0)
---
updated-dependencies:
- dependency-name: github.com/docker/cli
dependency-version: 28.5.1+incompatible
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-dependencies
- dependency-name: github.com/docker/docker
dependency-version: 28.5.1+incompatible
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
dependency-version: 0.43.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-dependencies
- dependency-name: golang.org/x/mod
dependency-version: 0.29.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-dependencies
- dependency-name: golang.org/x/oauth2
dependency-version: 0.32.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-dependencies
- dependency-name: golang.org/x/sys
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-dependencies
- dependency-name: golang.org/x/term
dependency-version: 0.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-dependencies
- dependency-name: golang.org/x/text
dependency-version: 0.30.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* fix(security): resolve CVE-GHSA-cgrx-mc8f-2prm by upgrading selinux to v1.13.0
Migrated from unmaintained GoogleContainerTools/kaniko to the actively maintained Chainguard fork (v1.25.4), updated lifecycle to v0.20.19, and upgraded opencontainers/selinux from v1.12.0 to v1.13.0 to fix GHSA-cgrx-mc8f-2prm. This also upgraded golang.org/x/crypto from v0.43.0 to v0.45.0, resolving additional CVEs.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* Use Docker API version negotiation instead of hardcoded version
Fixes #2464
This change replaces all hardcoded Docker API version 1.38 references
with WithAPIVersionNegotiation(), allowing pack to automatically adapt
to the Docker daemon's supported API version.
Changes:
- Updated main client initialization to use API version negotiation
- Updated SSH Docker client to use API version negotiation
- Updated all test files to use API version negotiation
- Upgraded fake-lifecycle test dependencies from Docker client v1.4.2 (2019) to v28.5.1
- Fixed fake-lifecycle imports and API calls for compatibility with modern Docker client
Benefits:
- Works with modern Docker daemons requiring API 1.44+ (Docker 27+)
- Backward compatible with older Docker versions
- Future-proof - no need to update hardcoded versions
- Solves Windows runner issue without requiring Docker 27 upgrade
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* Update Example_build test to use newer builder with modern lifecycle
The cnbs/sample-builder:noble builder includes a recent lifecycle version
that supports Docker API 1.44+, fixing the test failure on systems with
modern Docker daemons (Docker 27+).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* Downgrade fake-lifecycle dependencies for Go 1.23 compatibility
Updated fake-lifecycle test module to support Go 1.23.4 (Windows runner):
- Downgraded lifecycle from v0.20.11 to v0.19.3
- Downgraded go-containerregistry from v0.20.6 to v0.19.2
- Set Go requirement to 1.23 (compatible with Go 1.23.4)
- Updated Dockerfile to use golang:1.23 base image
The older versions still support Docker API 1.44+ and work correctly
with modern Docker daemons requiring minimum API version 1.44.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* updating fake-lifecycle go version
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* Use Docker API version negotiation instead of hardcoded version (#2474)
* Use Docker API version negotiation instead of hardcoded version
Fixes #2464
This change replaces all hardcoded Docker API version 1.38 references
with WithAPIVersionNegotiation(), allowing pack to automatically adapt
to the Docker daemon's supported API version.
Changes:
- Updated main client initialization to use API version negotiation
- Updated SSH Docker client to use API version negotiation
- Updated all test files to use API version negotiation
- Upgraded fake-lifecycle test dependencies from Docker client v1.4.2 (2019) to v28.5.1
- Fixed fake-lifecycle imports and API calls for compatibility with modern Docker client
Benefits:
- Works with modern Docker daemons requiring API 1.44+ (Docker 27+)
- Backward compatible with older Docker versions
- Future-proof - no need to update hardcoded versions
- Solves Windows runner issue without requiring Docker 27 upgrade
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* Update Example_build test to use newer builder with modern lifecycle
The cnbs/sample-builder:noble builder includes a recent lifecycle version
that supports Docker API 1.44+, fixing the test failure on systems with
modern Docker daemons (Docker 27+).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
* Downgrade fake-lifecycle dependencies for Go 1.23 compatibility
Updated fake-lifecycle test module to support Go 1.23.4 (Windows runner):
- Downgraded lifecycle from v0.20.11 to v0.19.3
- Downgraded go-containerregistry from v0.20.6 to v0.19.2
- Set Go requirement to 1.23 (compatible with Go 1.23.4)
- Updated Dockerfile to use golang:1.23 base image
The older versions still support Docker API 1.44+ and work correctly
with modern Docker daemons requiring minimum API version 1.44.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
---------
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
* fix code format
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>1 parent 6735aac commit 019eb74
4 files changed
+153
-144
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2 | 2 | | |
3 | 3 | | |
4 | 4 | | |
5 | | - | |
6 | 5 | | |
7 | 6 | | |
8 | 7 | | |
9 | 8 | | |
10 | | - | |
| 9 | + | |
| 10 | + | |
11 | 11 | | |
12 | 12 | | |
13 | | - | |
| 13 | + | |
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
| |||
34 | 34 | | |
35 | 35 | | |
36 | 36 | | |
37 | | - | |
| 37 | + | |
38 | 38 | | |
39 | 39 | | |
40 | 40 | | |
| |||
43 | 43 | | |
44 | 44 | | |
45 | 45 | | |
| 46 | + | |
46 | 47 | | |
47 | 48 | | |
48 | 49 | | |
| |||
54 | 55 | | |
55 | 56 | | |
56 | 57 | | |
57 | | - | |
| 58 | + | |
58 | 59 | | |
59 | | - | |
60 | | - | |
61 | | - | |
62 | | - | |
63 | | - | |
64 | | - | |
65 | | - | |
66 | | - | |
67 | | - | |
68 | | - | |
69 | | - | |
70 | | - | |
71 | | - | |
72 | | - | |
73 | | - | |
74 | | - | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
75 | 76 | | |
76 | 77 | | |
77 | 78 | | |
78 | 79 | | |
79 | 80 | | |
80 | 81 | | |
81 | | - | |
| 82 | + | |
82 | 83 | | |
83 | | - | |
| 84 | + | |
84 | 85 | | |
85 | 86 | | |
86 | 87 | | |
87 | | - | |
| 88 | + | |
88 | 89 | | |
89 | 90 | | |
90 | 91 | | |
| |||
105 | 106 | | |
106 | 107 | | |
107 | 108 | | |
108 | | - | |
| 109 | + | |
109 | 110 | | |
110 | | - | |
| 111 | + | |
111 | 112 | | |
112 | 113 | | |
113 | 114 | | |
114 | | - | |
| 115 | + | |
115 | 116 | | |
116 | 117 | | |
117 | 118 | | |
| |||
121 | 122 | | |
122 | 123 | | |
123 | 124 | | |
124 | | - | |
| 125 | + | |
125 | 126 | | |
126 | 127 | | |
127 | | - | |
| 128 | + | |
128 | 129 | | |
129 | | - | |
| 130 | + | |
130 | 131 | | |
131 | 132 | | |
132 | 133 | | |
133 | 134 | | |
134 | 135 | | |
135 | | - | |
| 136 | + | |
136 | 137 | | |
137 | | - | |
| 138 | + | |
138 | 139 | | |
139 | 140 | | |
140 | 141 | | |
141 | 142 | | |
142 | | - | |
| 143 | + | |
143 | 144 | | |
144 | | - | |
145 | | - | |
146 | | - | |
| 145 | + | |
| 146 | + | |
| 147 | + | |
| 148 | + | |
147 | 149 | | |
148 | 150 | | |
149 | | - | |
| 151 | + | |
150 | 152 | | |
151 | 153 | | |
152 | 154 | | |
153 | 155 | | |
154 | 156 | | |
155 | | - | |
| 157 | + | |
0 commit comments