From 6893e349199c51df2f961ffa52b3edb4c8e8d5a9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 23 Jun 2026 06:43:07 +0000 Subject: [PATCH] Bump github.com/containerd/containerd/v2 in /function Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.7 to 2.0.10. - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](https://github.com/containerd/containerd/compare/v2.0.7...v2.0.10) --- updated-dependencies: - dependency-name: github.com/containerd/containerd/v2 dependency-version: 2.0.10 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- function/go.mod | 2 +- function/go.sum | 4 ++-- .../containerd/containerd/v2/pkg/labels/labels.go | 12 ++++++++++++ .../containerd/containerd/v2/pkg/labels/validate.go | 9 +++++++++ .../containerd/containerd/v2/version/version.go | 2 +- function/vendor/modules.txt | 2 +- 6 files changed, 26 insertions(+), 5 deletions(-) diff --git a/function/go.mod b/function/go.mod index 2d8fd20..71b0b5f 100644 --- a/function/go.mod +++ b/function/go.mod @@ -11,7 +11,7 @@ require ( require ( github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect - github.com/containerd/containerd/v2 v2.0.7 // indirect + github.com/containerd/containerd/v2 v2.0.10 // indirect github.com/containerd/errdefs v1.0.0 // indirect github.com/containerd/log v0.1.0 // indirect github.com/containerd/platforms v1.0.0-rc.1 // indirect diff --git a/function/go.sum b/function/go.sum index d5ecebc..7145e93 100644 --- a/function/go.sum +++ b/function/go.sum @@ -12,8 +12,8 @@ github.com/containerd/cgroups/v3 v3.0.3 h1:S5ByHZ/h9PMe5IOQoN7E+nMc2UcLEM/V48DGD github.com/containerd/cgroups/v3 v3.0.3/go.mod h1:8HBe7V3aWGLFPd/k03swSIsGjZhHI2WzJmticMgVuz0= github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0= github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc= -github.com/containerd/containerd/v2 v2.0.7 h1:55JsNhqP/L7VZOijyfq6Qn0O8Oeff0UizfRuP+2pc90= -github.com/containerd/containerd/v2 v2.0.7/go.mod h1:su8B0Z1NFQMEIztOIbHwy7xtznbCms/kFlfsxIcQrZ8= +github.com/containerd/containerd/v2 v2.0.10 h1:l2ueLbt1HN1/WRl2pQvHM+7eEodjknAsXv1HLJ2Mz0Q= +github.com/containerd/containerd/v2 v2.0.10/go.mod h1:YdMdboz+mhlo+CQYGaLyUuqJBGlaz2OV2SA6dEMjvuo= github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII= github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= diff --git a/function/vendor/github.com/containerd/containerd/v2/pkg/labels/labels.go b/function/vendor/github.com/containerd/containerd/v2/pkg/labels/labels.go index 0f9bab5..ba4c245 100644 --- a/function/vendor/github.com/containerd/containerd/v2/pkg/labels/labels.go +++ b/function/vendor/github.com/containerd/containerd/v2/pkg/labels/labels.go @@ -16,6 +16,18 @@ package labels +// ReservedPrefix is the prefix of the label namespace reserved for labels +// defined and consumed by containerd itself. Labels in this namespace must +// not be copied from untrusted sources such as image config labels. Use +// IsReserved to check for such labels. +const ReservedPrefix = "containerd.io/" + +// CRIContainerdPrefix is the prefix of the label namespace reserved for +// labels defined and consumed by containerd's CRI plugin. Labels in this +// namespace must not be copied from untrusted sources such as image config +// labels. Use IsReserved to check for such labels. +const CRIContainerdPrefix = "io.cri-containerd" + // LabelUncompressed is added to compressed layer contents. // The value is digest of the uncompressed content. const LabelUncompressed = "containerd.io/uncompressed" diff --git a/function/vendor/github.com/containerd/containerd/v2/pkg/labels/validate.go b/function/vendor/github.com/containerd/containerd/v2/pkg/labels/validate.go index 6f23cdd..495427b 100644 --- a/function/vendor/github.com/containerd/containerd/v2/pkg/labels/validate.go +++ b/function/vendor/github.com/containerd/containerd/v2/pkg/labels/validate.go @@ -18,6 +18,7 @@ package labels import ( "fmt" + "strings" "github.com/containerd/errdefs" ) @@ -39,3 +40,11 @@ func Validate(k, v string) error { } return nil } + +// IsReserved returns true if the label key is in a namespace reserved for +// containerd (ReservedPrefix) or its CRI plugin (CRIContainerdPrefix). +// Reserved labels are interpreted by containerd and must not be copied from +// untrusted sources such as image config labels. +func IsReserved(k string) bool { + return strings.HasPrefix(k, ReservedPrefix) || strings.HasPrefix(k, CRIContainerdPrefix) +} diff --git a/function/vendor/github.com/containerd/containerd/v2/version/version.go b/function/vendor/github.com/containerd/containerd/v2/version/version.go index 98fb115..b5a436f 100644 --- a/function/vendor/github.com/containerd/containerd/v2/version/version.go +++ b/function/vendor/github.com/containerd/containerd/v2/version/version.go @@ -24,7 +24,7 @@ var ( Package = "github.com/containerd/containerd/v2" // Version holds the complete version number. Filled in at linking time. - Version = "2.0.7+unknown" + Version = "2.0.10+unknown" // Revision is filled with the VCS (e.g. git) revision being used to build // the program at linking time. diff --git a/function/vendor/modules.txt b/function/vendor/modules.txt index 286ed78..5e70800 100644 --- a/function/vendor/modules.txt +++ b/function/vendor/modules.txt @@ -56,7 +56,7 @@ github.com/aws/aws-sdk-go/service/sso/ssoiface github.com/aws/aws-sdk-go/service/ssooidc github.com/aws/aws-sdk-go/service/sts github.com/aws/aws-sdk-go/service/sts/stsiface -# github.com/containerd/containerd/v2 v2.0.7 +# github.com/containerd/containerd/v2 v2.0.10 ## explicit; go 1.23.0 github.com/containerd/containerd/v2/core/content github.com/containerd/containerd/v2/core/images