mirror of
https://github.com/woodpecker-ci/woodpecker.git
synced 2024-11-22 18:01:02 +00:00
6ffb3b1bd6
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [github.com/moby/moby](https://togithub.com/moby/moby) | `v24.0.8+incompatible` -> `v24.0.9+incompatible` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-24557](https://togithub.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc) The classic builder cache system is prone to cache poisoning if the image is built `FROM scratch`. Also, changes to some instructions (most important being `HEALTHCHECK` and `ONBUILD`) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. For example, an attacker could create an image that is considered as a valid cache candidate for: ``` FROM scratch MAINTAINER Pawel ``` when in fact the malicious image used as a cache would be an image built from a different Dockerfile. In the second case, the attacker could for example substitute a different `HEALTCHECK` command. ### Impact 23.0+ users are only affected if they explicitly opted out of Buildkit (`DOCKER_BUILDKIT=0` environment variable) or are using the `/build` API endpoint (which uses the classic builder by default). All users on versions older than 23.0 could be impacted. An example could be a CI with a shared cache, or just a regular Docker user pulling a malicious image due to misspelling/typosquatting. Image build API endpoint (`/build`) and `ImageBuild` function from `github.com/docker/docker/client` is also affected as it the uses classic builder by default. ### Patches Patches are included in Moby releases: - v25.0.2 - v24.0.9 ### Workarounds - Use `--no-cache` or use Buildkit if possible (`DOCKER_BUILDKIT=1`, it's default on 23.0+ assuming that the buildx plugin is installed). - Use `Version = types.BuilderBuildKit` or `NoCache = true` in `ImageBuildOptions` for `ImageBuild` call. --- ### Release Notes <details> <summary>moby/moby (github.com/moby/moby)</summary> ### [`v24.0.9+incompatible`](https://togithub.com/moby/moby/compare/v24.0.8...v24.0.9) [Compare Source](https://togithub.com/moby/moby/compare/v24.0.8...v24.0.9) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - "before 4am" (UTC). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/woodpecker-ci/woodpecker). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xNTMuMiIsInVwZGF0ZWRJblZlciI6IjM3LjE1My4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: qwerty287 <80460567+qwerty287@users.noreply.github.com>
164 lines
6.9 KiB
Modula-2
164 lines
6.9 KiB
Modula-2
module go.woodpecker-ci.org/woodpecker/v2
|
|
|
|
go 1.21
|
|
|
|
require (
|
|
code.gitea.io/sdk/gitea v0.17.1
|
|
codeberg.org/6543/go-yaml2json v1.0.0
|
|
codeberg.org/6543/xyaml v1.1.0
|
|
github.com/6543/logfile-open v1.2.1
|
|
github.com/alessio/shellescape v1.4.2
|
|
github.com/bmatcuk/doublestar/v4 v4.6.1
|
|
github.com/caddyserver/certmagic v0.20.0
|
|
github.com/cenkalti/backoff/v4 v4.2.1
|
|
github.com/distribution/reference v0.5.0
|
|
github.com/docker/cli v24.0.8+incompatible
|
|
github.com/docker/docker v24.0.8+incompatible
|
|
github.com/docker/go-connections v0.5.0
|
|
github.com/docker/go-units v0.5.0
|
|
github.com/drone/envsubst v1.0.3
|
|
github.com/expr-lang/expr v1.16.0
|
|
github.com/franela/goblin v0.0.0-20211003143422-0a4f594942bf
|
|
github.com/fsnotify/fsnotify v1.7.0
|
|
github.com/gin-gonic/gin v1.9.1
|
|
github.com/go-ap/httpsig v0.0.0-20221203064646-3647b4d88fdf
|
|
github.com/go-sql-driver/mysql v1.7.1
|
|
github.com/golang-jwt/jwt/v5 v5.2.0
|
|
github.com/google/go-github/v58 v58.0.0
|
|
github.com/google/tink/go v1.7.0
|
|
github.com/gorilla/securecookie v1.1.2
|
|
github.com/jellydator/ttlcache/v3 v3.1.1
|
|
github.com/joho/godotenv v1.5.1
|
|
github.com/kinbiko/jsonassert v1.1.1
|
|
github.com/lib/pq v1.10.9
|
|
github.com/mattn/go-sqlite3 v1.14.20
|
|
github.com/moby/moby v24.0.9+incompatible
|
|
github.com/moby/term v0.5.0
|
|
github.com/muesli/termenv v0.15.2
|
|
github.com/oklog/ulid/v2 v2.1.0
|
|
github.com/pkg/errors v0.9.1
|
|
github.com/prometheus/client_golang v1.18.0
|
|
github.com/robfig/cron v1.2.0
|
|
github.com/rs/zerolog v1.31.0
|
|
github.com/stretchr/testify v1.8.4
|
|
github.com/swaggo/files v1.0.1
|
|
github.com/swaggo/gin-swagger v1.6.0
|
|
github.com/swaggo/swag v1.16.2
|
|
github.com/tevino/abool/v2 v2.1.0
|
|
github.com/urfave/cli/v2 v2.27.1
|
|
github.com/xanzy/go-gitlab v0.96.0
|
|
github.com/xeipuuv/gojsonschema v1.2.0
|
|
go.uber.org/multierr v1.11.0
|
|
golang.org/x/crypto v0.18.0
|
|
golang.org/x/net v0.20.0
|
|
golang.org/x/oauth2 v0.16.0
|
|
golang.org/x/sync v0.6.0
|
|
golang.org/x/term v0.16.0
|
|
golang.org/x/text v0.14.0
|
|
google.golang.org/grpc v1.61.0
|
|
google.golang.org/protobuf v1.32.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
k8s.io/api v0.29.1
|
|
k8s.io/apimachinery v0.29.1
|
|
k8s.io/client-go v0.29.1
|
|
src.techknowlogick.com/xormigrate v1.7.1
|
|
xorm.io/builder v0.3.13
|
|
xorm.io/xorm v1.3.7
|
|
)
|
|
|
|
require (
|
|
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
|
|
github.com/KyleBanks/depth v1.2.1 // indirect
|
|
github.com/Microsoft/go-winio v0.6.1 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/bytedance/sonic v1.10.2 // indirect
|
|
github.com/cespare/xxhash/v2 v2.2.0 // indirect
|
|
github.com/chenzhuoyu/base64x v0.0.0-20230717121745-296ad89f973d // indirect
|
|
github.com/chenzhuoyu/iasm v0.9.1 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/davidmz/go-pageant v1.0.2 // indirect
|
|
github.com/docker/distribution v2.8.3+incompatible // indirect
|
|
github.com/docker/docker-credential-helpers v0.8.0 // indirect
|
|
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
|
|
github.com/fatih/color v1.13.0 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.3 // indirect
|
|
github.com/gin-contrib/sse v0.1.0 // indirect
|
|
github.com/go-fed/httpsig v1.1.0 // indirect
|
|
github.com/go-logr/logr v1.4.1 // indirect
|
|
github.com/go-openapi/jsonpointer v0.20.2 // indirect
|
|
github.com/go-openapi/jsonreference v0.20.4 // indirect
|
|
github.com/go-openapi/spec v0.20.13 // indirect
|
|
github.com/go-openapi/swag v0.22.6 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.16.0 // indirect
|
|
github.com/goccy/go-json v0.10.2 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/protobuf v1.5.3 // indirect
|
|
github.com/golang/snappy v0.0.4 // indirect
|
|
github.com/google/gnostic-models v0.6.8 // indirect
|
|
github.com/google/go-cmp v0.6.0 // indirect
|
|
github.com/google/go-querystring v1.1.0 // indirect
|
|
github.com/google/gofuzz v1.2.0 // indirect
|
|
github.com/google/uuid v1.5.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-hclog v1.2.0 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
|
|
github.com/hashicorp/go-version v1.6.0 // indirect
|
|
github.com/imdario/mergo v0.3.16 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.2.6 // indirect
|
|
github.com/leodido/go-urn v1.2.4 // indirect
|
|
github.com/libdns/libdns v0.2.1 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
|
|
github.com/mailru/easyjson v0.7.7 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-runewidth v0.0.15 // indirect
|
|
github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
|
|
github.com/mholt/acmez v1.2.0 // indirect
|
|
github.com/miekg/dns v1.1.57 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/morikuni/aec v1.0.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.0.2 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.1.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/prometheus/client_model v0.5.0 // indirect
|
|
github.com/prometheus/common v0.45.0 // indirect
|
|
github.com/prometheus/procfs v0.12.0 // indirect
|
|
github.com/rivo/uniseg v0.4.4 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/sirupsen/logrus v1.9.3 // indirect
|
|
github.com/spf13/pflag v1.0.5 // indirect
|
|
github.com/stretchr/objx v0.5.1 // indirect
|
|
github.com/syndtr/goleveldb v1.0.0 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.2.12 // indirect
|
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
|
github.com/xrash/smetrics v0.0.0-20231213231151-1d8dd44e695e // indirect
|
|
github.com/zeebo/blake3 v0.2.3 // indirect
|
|
go.uber.org/zap v1.26.0 // indirect
|
|
golang.org/x/arch v0.6.0 // indirect
|
|
golang.org/x/mod v0.14.0 // indirect
|
|
golang.org/x/sys v0.16.0 // indirect
|
|
golang.org/x/time v0.5.0 // indirect
|
|
golang.org/x/tools v0.16.1 // indirect
|
|
google.golang.org/appengine v1.6.8 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20231212172506-995d672761c0 // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
|
gotest.tools/v3 v3.4.0 // indirect
|
|
k8s.io/klog/v2 v2.110.1 // indirect
|
|
k8s.io/kube-openapi v0.0.0-20231214164306-ab13479f8bf8 // indirect
|
|
k8s.io/utils v0.0.0-20231127182322-b307cd553661 // indirect
|
|
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
|
|
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
|
|
sigs.k8s.io/yaml v1.4.0 // indirect
|
|
)
|