-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
🌱 bump github.com/docker/docker from 25.0.4+incompatible to 25.0.5+incompatible #10302
Conversation
/cc @nawazkh |
Thank you for identifying this @mboersma |
/lgtm |
LGTM label has been added. Git tree hash: b5fda7c1f69f27af4cf3e4ff150a5be7d994ca5a
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
I did a high-level triage. I don't see anything blocking Dependabot on fixing this CVE(as per dependabot's config at the root/.github folder). As Matt said, dependabot would have come around this eventually to fix the CVE. |
@mboersma thank you for the patch, we had the same alert via dependabot on an infra provider repository. Is there a reason not to directly update to 26.0.0 in this case.
I think this is a repository settings and maybe we don't have it enabled for this repository. |
/approve |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: sbueringer The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
@sbueringer 👋 you see any issues with backporting this to release-1.5 and release-1.6 branches to address the failing security scans? https://github.com/kubernetes-sigs/cluster-api/actions/runs/8419719374/job/23052938757 |
No that's fine, might need manual cherry-picks though |
/cherry-pick release-1.6 |
/cherry-pick release-1.5 |
@sbueringer: #10302 failed to apply on top of branch "release-1.6":
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
@sbueringer: #10302 failed to apply on top of branch "release-1.5":
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
@cahillsf Let's try to stay on the same docker major version when we open PRs for 1.6 & 1.5 |
What this PR does / why we need it:
Bumps github.com/docker/docker from 25.0.4+incompatible to 25.0.5+incompatible.
Dependabot will probably get around to this, but I wanted to update it because it's problematic for CAPZ incorporating CAPI v1.7.0-beta.0. Docker becomes an indirect import in CAPZ, and then our dependency checker fails:
Which issue(s) this PR fixes:
See GHSA-mq39-4gv4-mvpx
See kubernetes-sigs/cluster-api-provider-azure#4646
/area dependency
/area security