From f4426e3fd2788ad4e2519863a31aad8b6967285e Mon Sep 17 00:00:00 2001 From: "HeraldBot[bot]" <149080493+heraldbot[bot]@users.noreply.github.com> Date: Fri, 2 Oct 2026 09:14:45 +0000 Subject: [PATCH] fix(nancy): remediate nancy findings --- .nancy-ignore | 23 ++++++++++++----------- go.mod | 2 ++ go.sum | 4 ++-- 3 files changed, 16 insertions(+), 13 deletions(-) diff --git a/.nancy-ignore b/.nancy-ignore index fc65cb993..30e86a7db 100644 --- a/.nancy-ignore +++ b/.nancy-ignore @@ -1,19 +1,20 @@ -CVE-2026-26958 until=2026-09-27 # filippo.io/edwards25519@v1.1.0 -CVE-2026-10722 until=2026-09-27 # github.com/cilium/ebpf@v0.9.1 +CVE-2026-26958 until=2026-11-01 # filippo.io/edwards25519@v1.1.0 CVE-2025-47290 until=2026-10-08 # github.com/containerd/containerd@v1.7.33 CVE-2025-47291 until=2026-10-08 # github.com/containerd/containerd@v1.7.33 -CVE-2026-63209 until=2026-09-27 # github.com/klauspost/compress@v1.18.4 -CVE-2024-0406 until=2026-09-27 # github.com/mholt/archiver/v3@v3.5.1 -CVE-2025-3445 until=2026-09-27 # github.com/mholt/archiver/v3@v3.5.1 -CVE-2026-56864 until=2026-09-27 # golang.org/x/mod@v0.37.0 -CVE-2026-56865 until=2026-09-27 # golang.org/x/mod@v0.37.0 -CVE-2026-63308 until=2026-09-27 # helm.sh/helm/v3@v3.21.4 -CVE-2026-48978 until=2026-09-27 # oras.land/oras-go@v1.2.7 -CVE-2026-56854 until=2026-09-30 # golang.org/x/crypto@v0.54.0 -CVE-2026-37236 until=2026-10-01 # github.com/grpc-ecosystem/grpc-gateway/v2@v2.28.0 CVE-2026-81871 until=2026-10-03 # go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.19.0 CVE-2026-81870 until=2026-10-03 # go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.43.0 CVE-2026-81872 until=2026-10-03 # go.opentelemetry.io/otel/sdk/log@v0.19.0 CVE-2026-56855 until=2026-10-08 # golang.org/x/crypto@v0.55.0 CVE-2026-53495 until=2026-10-08 # github.com/containerd/containerd@v1.7.33 CVE-2026-78662 until=2026-10-08 # golang.org/x/crypto@v0.55.0 +CVE-2026-10722 until=2026-11-01 # github.com/cilium/ebpf@v0.9.1 +CVE-2026-85747 until=2026-11-01 # github.com/distribution/distribution/v3@v3.1.1 +CVE-2026-37236 until=2026-11-01 # github.com/grpc-ecosystem/grpc-gateway/v2@v2.28.0 +CVE-2026-63209 until=2026-11-01 # github.com/klauspost/compress@v1.18.4 +CVE-2025-3445 until=2026-11-01 # github.com/mholt/archiver/v3@v3.5.1 +CVE-2024-0406 until=2026-11-01 # github.com/mholt/archiver/v3@v3.5.1 +CVE-2026-56864 until=2026-11-01 # golang.org/x/mod@v0.38.0 +CVE-2026-56865 until=2026-11-01 # golang.org/x/mod@v0.38.0 +CVE-2026-63308 until=2026-11-01 # helm.sh/helm/v3@v3.21.4 +CVE-2026-85732 until=2026-11-01 # oras.land/oras-go@v1.2.7 +CVE-2026-48978 until=2026-11-01 # oras.land/oras-go@v1.2.7 diff --git a/go.mod b/go.mod index 19da5a10a..60a8457bb 100644 --- a/go.mod +++ b/go.mod @@ -184,3 +184,5 @@ replace github.com/yuin/goldmark v1.2.1 => github.com/yuin/goldmark v1.8.5 replace oras.land/oras-go/v2 v2.6.1 => oras.land/oras-go/v2 v2.6.2 replace google.golang.org/grpc v1.82.1 => google.golang.org/grpc v1.83.2 + +replace github.com/containerd/containerd v1.7.33 => github.com/containerd/containerd v1.7.36 diff --git a/go.sum b/go.sum index 974998d09..09f21394a 100644 --- a/go.sum +++ b/go.sum @@ -64,8 +64,8 @@ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM= github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw= -github.com/containerd/containerd v1.7.33 h1:iAkYGC/ifR/V+0eR4iXWHNGYUF0DF2PmGV5iz4Irj5M= -github.com/containerd/containerd v1.7.33/go.mod h1:gSbSCVjPCdkfJCjyrzz7aRC+xFlqVbatNpfHfVCYGUM= +github.com/containerd/containerd v1.7.36 h1:HyMsOG5kmp1LQsGzqwI6Ts06T4VpYZbszfDZYB0bW5w= +github.com/containerd/containerd v1.7.36/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII= github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE= github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=