Update dependencies to include security patches reported by dependabot for agent #3367
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yinyic
changed the title
yinyic
force-pushed
the
dependabot-agent
branch
from
0fecc49
to
dec41b4
Compare
yinyic
force-pushed
the
dependabot-agent
branch
from
dec41b4
to
fc82277
Compare
yinyic
force-pushed
the
dependabot-agent
branch
from
f56f218
to
a060984
Compare
yinyic
force-pushed
the
dependabot-agent
branch
from
a060984
to
4cdd048
Compare
yinyic
force-pushed
the
dependabot-agent
branch
from
fc76228
to
c088bac
Compare
Realmonia
previously approved these changes
Aug 29, 2022
fierlion
previously approved these changes
Aug 29, 2022
Realmonia
approved these changes
Aug 30, 2022
fierlion
approved these changes
Aug 30, 2022
I've not looked into v1.x, but would expect to see maybe some more API changes that need to be addressed, considering it's a major version bump. It's probably better to take up a separate task for the upgrade. Also, it may be helpful to sync up with CNI version in https://github.com/aws/amazon-vpc-cni-plugins (currently at 0.8.1) |
Merged
chienhanlin
pushed a commit
that referenced
this pull request
Sep 6, 2022
…t for agent (#3367) * Upgrade github.com/containernetworking/cni to 0.8.1 * Upgrade github.com/containerd/containerd to v1.4.13 * Fix goimports * Fix logging data race * Address required network name field for updated CNI spec * Address ifname size limit
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Update dependencies to include security patches reported by dependabot for agent
Implementation details
Ran
go get,go mod tidyandgo mod vendorto updatedpackages that have security vulnerabilities called out by dependabot.For
amazon-ecs-agent/agent, affected packages arecontainernetworking/cni- upgrade to use0.8.1Result.String()was removed from CNI API in this PR. We will simply print the struct instead. We also reran mock gen for ecscni package to address the API changes.Nameis now required to be non-empty during CNI invocation due to this PR. We will add a placeholder string to fulfill the spec.ifname(interface name) now needs to be less than 14 characters due to this PRgit.luolix.top/docker/docker- upgrade to use1.6.1- we are already using a newer version released in 2020, while1.6.1was released in year 2015git.luolix.top/containerd/containerdTesting
make testmake releaseNew tests cover the changes: no
Description for the changelog
Update dependencies to include security patches reported by dependabot for agent
Licensing
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.