Skip to content

build(deps): bump the stargz group across 1 directory with 3 updates - #5262

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/stargz-e76767c184
Closed

build(deps): bump the stargz group across 1 directory with 3 updates#5262
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/stargz-e76767c184

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the stargz group with 3 updates in the / directory: github.com/containerd/stargz-snapshotter, github.com/containerd/stargz-snapshotter/estargz and github.com/containerd/stargz-snapshotter/ipfs.

Updates github.com/containerd/stargz-snapshotter from 0.18.2 to 0.19.0

Release notes

Sourced from github.com/containerd/stargz-snapshotter's releases.

v0.19.0

Security Updates

  • CVE-2026-71482
  • CVE-2026-77395
    • To mitigate this issue, v0.19.0 requires a configuration change to the CRI setting. Specifically, the --image-service-endpoint=unix:///run/containerd-stargz-grpc/containerd-stargz-grpc.sock flag needs to be specified on kubelet. Refer to kubelet configuration section in docs/overview.md for details.

Notable Changes

  • estargz: Fix encoder panic in go 1.27 by emitting footer manually (#2333)
  • ctr-remote i optimize: GPU: migrate to CDI (#2334)
  • fs: add ns query parameter to mirror requests per OCI distribution spec (#2363), thanks to @​simonepri
  • fusemanager: Add a dedicated metrics endpoint (#2356), thanks to @​mironovgh
  • estargz: add --estargz-parallelism to control build parallelism (#2341), thanks to @​simonepri
  • Reset instead of dropping registry traffic in integration tests (#2362), thanks to @​kzys
  • Build the k3s node image with make image (#2361), thanks to @​kzys
  • simplify waiter implementation in fs (#2270), thanks to @​wswsmao
  • estargz: fix panic in GzipDecompressor.ParseFooter on empty Extra field (#2256), thanks to @​kylos101
  • go.mod remove excludes that are no longer needed (#2254), thanks to @​thaJeztah
  • estargz: deprecate errorutil in favor of native errors.Join (#2247), thanks to @​thaJeztah
  • estargz: Build: replace golang.org/x/sync with WaitGroup.Go (go1.25) (#2249), thanks to @​thaJeztah
  • modernize some code (#2248), thanks to @​thaJeztah
Commits
  • 1bcc28b Merge pull request #2407 from ktock/prepare-0.19.0
  • ae2958c Prepare for v0.19.0
  • 543a9b0 CI: fix TTY error of docker exec
  • 14cc201 fix go.mod with make vendor
  • 43f2fe6 CI: fix flakiness of CRIValidationContainerd
  • 23cdd04 Merge commit from fork
  • 6bc91be Merge commit from fork
  • d299bec docs: add kubelet configuration sections
  • b008eee ctr-remote: call verifier before pulling an image
  • a7df9a0 estargz: add a test for cyclic hardlink
  • Additional commits viewable in compare view

Updates github.com/containerd/stargz-snapshotter/estargz from 0.18.2 to 0.19.0

Release notes

Sourced from github.com/containerd/stargz-snapshotter/estargz's releases.

v0.19.0

Security Updates

  • CVE-2026-71482
  • CVE-2026-77395
    • To mitigate this issue, v0.19.0 requires a configuration change to the CRI setting. Specifically, the --image-service-endpoint=unix:///run/containerd-stargz-grpc/containerd-stargz-grpc.sock flag needs to be specified on kubelet. Refer to kubelet configuration section in docs/overview.md for details.

Notable Changes

  • estargz: Fix encoder panic in go 1.27 by emitting footer manually (#2333)
  • ctr-remote i optimize: GPU: migrate to CDI (#2334)
  • fs: add ns query parameter to mirror requests per OCI distribution spec (#2363), thanks to @​simonepri
  • fusemanager: Add a dedicated metrics endpoint (#2356), thanks to @​mironovgh
  • estargz: add --estargz-parallelism to control build parallelism (#2341), thanks to @​simonepri
  • Reset instead of dropping registry traffic in integration tests (#2362), thanks to @​kzys
  • Build the k3s node image with make image (#2361), thanks to @​kzys
  • simplify waiter implementation in fs (#2270), thanks to @​wswsmao
  • estargz: fix panic in GzipDecompressor.ParseFooter on empty Extra field (#2256), thanks to @​kylos101
  • go.mod remove excludes that are no longer needed (#2254), thanks to @​thaJeztah
  • estargz: deprecate errorutil in favor of native errors.Join (#2247), thanks to @​thaJeztah
  • estargz: Build: replace golang.org/x/sync with WaitGroup.Go (go1.25) (#2249), thanks to @​thaJeztah
  • modernize some code (#2248), thanks to @​thaJeztah
Commits
  • 1bcc28b Merge pull request #2407 from ktock/prepare-0.19.0
  • ae2958c Prepare for v0.19.0
  • 543a9b0 CI: fix TTY error of docker exec
  • 14cc201 fix go.mod with make vendor
  • 43f2fe6 CI: fix flakiness of CRIValidationContainerd
  • 23cdd04 Merge commit from fork
  • 6bc91be Merge commit from fork
  • d299bec docs: add kubelet configuration sections
  • b008eee ctr-remote: call verifier before pulling an image
  • a7df9a0 estargz: add a test for cyclic hardlink
  • Additional commits viewable in compare view

Updates github.com/containerd/stargz-snapshotter/ipfs from 0.18.2 to 0.19.0

Release notes

Sourced from github.com/containerd/stargz-snapshotter/ipfs's releases.

v0.19.0

Security Updates

  • CVE-2026-71482
  • CVE-2026-77395
    • To mitigate this issue, v0.19.0 requires a configuration change to the CRI setting. Specifically, the --image-service-endpoint=unix:///run/containerd-stargz-grpc/containerd-stargz-grpc.sock flag needs to be specified on kubelet. Refer to kubelet configuration section in docs/overview.md for details.

Notable Changes

  • estargz: Fix encoder panic in go 1.27 by emitting footer manually (#2333)
  • ctr-remote i optimize: GPU: migrate to CDI (#2334)
  • fs: add ns query parameter to mirror requests per OCI distribution spec (#2363), thanks to @​simonepri
  • fusemanager: Add a dedicated metrics endpoint (#2356), thanks to @​mironovgh
  • estargz: add --estargz-parallelism to control build parallelism (#2341), thanks to @​simonepri
  • Reset instead of dropping registry traffic in integration tests (#2362), thanks to @​kzys
  • Build the k3s node image with make image (#2361), thanks to @​kzys
  • simplify waiter implementation in fs (#2270), thanks to @​wswsmao
  • estargz: fix panic in GzipDecompressor.ParseFooter on empty Extra field (#2256), thanks to @​kylos101
  • go.mod remove excludes that are no longer needed (#2254), thanks to @​thaJeztah
  • estargz: deprecate errorutil in favor of native errors.Join (#2247), thanks to @​thaJeztah
  • estargz: Build: replace golang.org/x/sync with WaitGroup.Go (go1.25) (#2249), thanks to @​thaJeztah
  • modernize some code (#2248), thanks to @​thaJeztah
Commits
  • 1bcc28b Merge pull request #2407 from ktock/prepare-0.19.0
  • ae2958c Prepare for v0.19.0
  • 543a9b0 CI: fix TTY error of docker exec
  • 14cc201 fix go.mod with make vendor
  • 43f2fe6 CI: fix flakiness of CRIValidationContainerd
  • 23cdd04 Merge commit from fork
  • 6bc91be Merge commit from fork
  • d299bec docs: add kubelet configuration sections
  • b008eee ctr-remote: call verifier before pulling an image
  • a7df9a0 estargz: add a test for cyclic hardlink
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Oct 14, 2026
@ktock ktock mentioned this pull request Oct 15, 2026
Merged
@dependabot dependabot Bot changed the title build(deps): bump the stargz group with 3 updates build(deps): bump the stargz group across 1 directory with 3 updates Oct 15, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/stargz-e76767c184 branch 6 times, most recently from 5865bdc to bf92f3f Compare October 21, 2026 18:29
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/stargz-e76767c184 branch from bf92f3f to fe2487a Compare October 27, 2026 08:03
@dependabot
build(deps): bump the stargz group across 1 directory with 3 updates
d96682f 
Bumps the stargz group with 3 updates in the / directory: [github.com/containerd/stargz-snapshotter](https://github.com/containerd/stargz-snapshotter), [github.com/containerd/stargz-snapshotter/estargz](https://github.com/containerd/stargz-snapshotter) and [github.com/containerd/stargz-snapshotter/ipfs](https://github.com/containerd/stargz-snapshotter).


Updates `github.com/containerd/stargz-snapshotter` from 0.18.2 to 0.19.0
- [Release notes](https://github.com/containerd/stargz-snapshotter/releases)
- [Commits](containerd/stargz-snapshotter@v0.18.2...v0.19.0)

Updates `github.com/containerd/stargz-snapshotter/estargz` from 0.18.2 to 0.19.0
- [Release notes](https://github.com/containerd/stargz-snapshotter/releases)
- [Commits](containerd/stargz-snapshotter@v0.18.2...v0.19.0)

Updates `github.com/containerd/stargz-snapshotter/ipfs` from 0.18.2 to 0.19.0
- [Release notes](https://github.com/containerd/stargz-snapshotter/releases)
- [Commits](containerd/stargz-snapshotter@v0.18.2...v0.19.0)

---
updated-dependencies:
- dependency-name: github.com/containerd/stargz-snapshotter
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stargz
- dependency-name: github.com/containerd/stargz-snapshotter/estargz
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stargz
- dependency-name: github.com/containerd/stargz-snapshotter/ipfs
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: stargz
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/stargz-e76767c184 branch from fe2487a to d96682f Compare October 27, 2026 22:32
@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/go_modules/stargz-e76767c184 branch October 27, 2026 22:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@ktock ktock

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ktock