Skip to content

fix(deps): vuln minor upgrades — 7 packages (minor: 4 · patch: 3) [test/e2e]#3147

Merged
tbavelier merged 2 commits into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948
Jun 29, 2026
Merged

fix(deps): vuln minor upgrades — 7 packages (minor: 4 · patch: 3) [test/e2e]#3147
tbavelier merged 2 commits into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Summary: High-severity security update — 7 packages upgraded (MINOR changes included)

Manifests changed:

  • test/e2e (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
github.com/moby/spdystream v0.5.0 v0.5.1 patch Transitive 2 HIGH
github.com/go-git/go-git/v5 v5.16.5 v5.19.1 minor Transitive 1 HIGH, 6 MEDIUM, 4 LOW
github.com/go-git/go-billy/v5 v5.6.2 v5.9.0 minor Transitive 1 HIGH, 1 MEDIUM
github.com/containerd/containerd v1.7.30 v1.7.32 patch Transitive 1 HIGH
github.com/aws/aws-sdk-go-v2/service/s3 v1.93.1 v1.103.3 minor Transitive 1 MEDIUM
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 v1.7.13 patch Transitive 1 MEDIUM
golang.org/x/crypto v0.51.0 v0.53.0 minor Transitive 13 UNKNOWN

Security Details

🚨 Critical & High Severity (5 fixed)
Package CVE Severity Summary Unsafe Version Fixed In
github.com/containerd/containerd GHSA-fqw6-gf59-qr4w HIGH containerd user ID handling bypass allows runAsNonRoot evasion v1.7.30 1.7.32
github.com/go-git/go-billy/v5 GHSA-qw64-3x98-g7q2 HIGH go-billy has path traversal vulnerabilities v5.6.2 5.9.0
github.com/go-git/go-git/v5 GHSA-389r-gv7p-r3rp HIGH go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git v5.16.5 5.19.0
github.com/moby/spdystream GHSA-pc3f-x583-g7j2 HIGH SpdyStream: DOS on CRI v0.5.0 0.5.1
github.com/moby/spdystream GO-2026-4958 HIGH Uncontrolled resource consumption when parsing SPDY frames in github.com/moby/spdystream v0.5.0 0.5.1
ℹ️ Other Vulnerabilities (26)
Package CVE Severity Summary Unsafe Version Fixed In
github.com/go-git/go-git/v5 GO-2026-4910 medium Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git v5.16.5 5.17.1
github.com/go-git/go-git/v5 CVE-2026-34165 medium go-git: Maliciously crafted idx file can cause asymmetric memory consumption v5.16.5 -
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream GHSA-xmrv-pmrh-hhx2 MODERATE Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder v1.7.4 1.7.8
github.com/aws/aws-sdk-go-v2/service/s3 GHSA-xmrv-pmrh-hhx2 MODERATE Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder v1.93.1 1.97.3
github.com/go-git/go-billy/v5 GHSA-m3xc-h892-ggx6 MODERATE go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion v5.6.2 5.9.0
github.com/go-git/go-git/v5 GHSA-w5pp-99ch-qj29 MODERATE go-git: Malformed Git object data may cause panics or resource exhaustion v5.16.5 5.19.1
github.com/go-git/go-git/v5 GHSA-3xc5-wrhm-f963 MODERATE go-git: Credential leak via cross-host redirect in smart HTTP transport v5.16.5 5.18.0
github.com/go-git/go-git/v5 GHSA-crhj-59gh-8x96 MODERATE go-git: Crafted repositories may modify main and submodule .git directories v5.16.5 5.19.1
github.com/go-git/go-git/v5 GHSA-jhf3-xxhw-2wpp MODERATE go-git: Maliciously crafted idx file can cause asymmetric memory consumption v5.16.5 5.17.1
github.com/go-git/go-git/v5 GHSA-m7cr-m3pv-hgrp LOW go-git: Improper single-quote escaping in go-git SSH transport v5.16.5 5.19.1
github.com/go-git/go-git/v5 GO-2026-4909 LOW Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git v5.16.5 5.17.1
github.com/go-git/go-git/v5 CVE-2026-33762 LOW go-git: Missing validation decoding Index v4 files leads to panic v5.16.5 -
github.com/go-git/go-git/v5 GHSA-gm2x-2g9h-ccm8 LOW go-git missing validation decoding Index v4 files leads to panic v5.16.5 5.17.1
golang.org/x/crypto GO-2026-5016 unknown Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5013 unknown Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5021 unknown Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5005 unknown Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5019 unknown Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5018 unknown Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5014 unknown Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5017 unknown Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5006 unknown Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5015 unknown Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5033 unknown Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5020 unknown Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh v0.51.0 0.52.0
golang.org/x/crypto GO-2026-5023 unknown Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh v0.51.0 0.52.0

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@datadog-prod-us1-3

This comment has been minimized.

Sign in to view
@codecov-commenter

codecov-commenter commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.79%. Comparing base (68e2ee9) to head (ea89383).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main    #3147   +/-   ##
=======================================
  Coverage   43.79%   43.79%           
=======================================
  Files         375      375           
  Lines       30575    30575           
=======================================
  Hits        13390    13390           
  Misses      16276    16276           
  Partials      909      909
Flag Coverage Δ
unittests 43.79% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 68e2ee9...ea89383. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gh-worker-campaigns-3e9aa4

gh-worker-campaigns-3e9aa4 Bot commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Auto-rebase failed

Lockfile regeneration failed during rebase onto main. Your branch was not updated. You may need to rebase and regenerate lockfiles manually.

Error details

child workflow execution error (type: engraver.Engraver_AllManagersWorkflow, workflowID: 019eee53-94f3-7b77-bb74-da49dcac4376_57, runID: 019eee53-b5e8-78b6-8849-3dca88d6129d, initiatedEventID: 57, startedEventID: 58): activity error (type: engraver.Engraver_GetChanges, scheduledEventID: 8, startedEventID: 9, identity: 1@engraver-worker-54fc6f45bb-hrxk8@): unable to clone github repository: git clone failed: exit status 128 (type: wrapError, retryable: true): git clone failed: exit status 128 (type: wrapError, retryable: true): exit status 128 (type: ExitError, retryable: true)

Auto-Rebase · Add no-auto-rebase to opt out

@gh-worker-campaigns-3e9aa4

gh-worker-campaigns-3e9aa4 Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Auto-rebase complete

Branch is up to date with main — rebased onto 0286aa5.

Auto-Rebase · Add no-auto-rebase to opt out

@dd-octo-sts
dd-octo-sts Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch from ea89383 to 20092dd Compare June 22, 2026 15:30
@dd-octo-sts-4aefcb
dd-octo-sts-4aefcb Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch from 20092dd to d184aa9 Compare June 23, 2026 17:16
@dd-octo-sts-26fcfa
dd-octo-sts-26fcfa Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch 2 times, most recently from d46b714 to 0d928a2 Compare June 24, 2026 13:27
@dd-octo-sts-4191dd
dd-octo-sts-4191dd Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch from 0d928a2 to 94df2d2 Compare June 24, 2026 13:38
@levan-m levan-m added dependencies Pull requests that update a dependency file qa/skip-qa labels Jun 24, 2026
@dd-octo-sts-4aefcb
dd-octo-sts-4aefcb Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch from 94df2d2 to 97f5dbd Compare June 25, 2026 09:02
@dd-octo-sts-6354d5
dd-octo-sts-6354d5 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch 2 times, most recently from f54f7a7 to 3e7ff09 Compare June 25, 2026 11:11
@dd-octo-sts-b8cf80
dd-octo-sts-b8cf80 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch from 3e7ff09 to 16afb6b Compare June 25, 2026 12:21
@dd-octo-sts-09fbc5
dd-octo-sts-09fbc5 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch from 16afb6b to 1688972 Compare June 25, 2026 12:24
@dd-octo-sts-150931 @dd-octo-sts-09fbc5
ADMS: vuln minor upgrades — 7 packages (minor: 4 · patch: 3) [test/e2e]
7b69497 
Co-authored-by: dd-octo-sts-09fbc5[bot] <256648608+dd-octo-sts-09fbc5[bot]@users.noreply.github.com>
@dd-octo-sts-150931
dd-octo-sts-150931 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch from 1688972 to 7b69497 Compare June 25, 2026 15:14
@levan-m
levan-m marked this pull request as ready for review June 25, 2026 15:22
@levan-m
levan-m requested a review from a team June 25, 2026 15:22
@dd-prapprover-prod-77c48c

dd-prapprover-prod-77c48c Bot commented Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

  • ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-06-25T15:22:54Z
  • ✅ CI tests passed - 2026-06-25T17:10:39Z
  • ✅ Approved (commit: 7b69497) - 2026-06-25T17:10:42Z
  • ✅ Merge Started
  • ⬜ Merged

➡️ Current phase: merge in progress...

dd-prapprover-prod-77c48c[bot]
dd-prapprover-prod-77c48c Bot previously approved these changes Jun 25, 2026
View reviewed changes

@dd-prapprover-prod-77c48c dd-prapprover-prod-77c48c Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR has been automatically approved by the DD PR Approver bot.

@levan-m
levan-m requested a review from a team as a code owner June 27, 2026 00:27
@dd-prapprover-prod-77c48c
dd-prapprover-prod-77c48c Bot dismissed their stale review June 27, 2026 00:27

new commit added, dismiss all previous approvals

@levan-m
levan-m force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch from 654183a to ca42fd5 Compare June 27, 2026 00:33
@gh-worker-ownership-write-b05516
gh-worker-ownership-write-b05516 Bot removed request for a team June 27, 2026 00:33
@levan-m
Merge remote-tracking branch 'origin/main' into engraver-auto-version…
c82787c 
…-upgrade/minorpatch/go/e2e/0-1781562948

# Conflicts:
#	test/e2e/go.mod
#	test/e2e/go.sum
@levan-m
levan-m force-pushed the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch from ca42fd5 to c82787c Compare June 27, 2026 00:39
@tbavelier
tbavelier merged commit 0206a27 into main Jun 29, 2026
39 checks passed
@tbavelier
tbavelier deleted the engraver-auto-version-upgrade/minorpatch/go/e2e/0-1781562948 branch June 29, 2026 07:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tbavelier tbavelier tbavelier approved these changes
@levan-m levan-m levan-m approved these changes
@dd-prapprover-prod-77c48c dd-prapprover-prod-77c48c[bot] dd-prapprover-prod-77c48c[bot] left review comments

Assignees

No one assigned

Labels

adms-dependency-update adms-go adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns campaigner-automated-change dependencies Pull requests that update a dependency file qa/skip-qa team/container-platform

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@codecov-commenter @tbavelier @levan-m