Upgrade testcontainers to v0.43 and x/crypto to v0.54 - #1741
Merged
Conversation
- Upgrade dependencies to address security vulnerabilities. - Testcontainers v0.42.0 introduced a port API change as part of the Moby module migration which requires a code change in `test_utils.go`
ericyan
changed the title
x/crypto to v0.54
ericyan
marked this pull request as ready for review
July 29, 2026 10:39
jakubpliszka
approved these changes
Jul 29, 2026
davidham
added a commit
to davidham/gh-ost
that referenced
this pull request
Jul 29, 2026
go/logic/test_utils.go has no _test.go suffix, so it is part of the ordinary build of package logic. It imports testcontainers-go, and package logic is imported by go/cmd/gh-ost, so testcontainers and its transitive dependencies are compiled into the released gh-ost binary and recorded in its build info. Container-testing infrastructure has no role at runtime. Shipping it enlarges the binary and widens the dependency surface that scanners report against, which is how the vendored Docker client came to account for 3 HIGH CVEs in the v1.1.10 binary (github#1738). Upgrading testcontainers in github#1741 cleared those particular findings, but the structural issue remains: a future advisory anywhere in the container-testing tree would again surface in scans of a binary that never calls into it. Rename the file to test_utils_test.go so it stays available to the tests in the same package while being excluded from the ordinary build. Every identifier it declares is referenced only from applier_test.go, streamer_test.go and migrator_test.go, so this is a pure rename with no content change. Effect on the linux/amd64 binary, built with go1.25.12: - modules recorded in build info: 63 -> 22 - binary size: 18.64 MB -> 16.99 MB - Trivy HIGH/CRITICAL: 0 -> 0, unchanged; master is already clean
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR upgrades
testcontainersto v0.43.0 andx/cryptoto v0.54.0. This is to address security vulnerabilities.Related issue: #1738
Testcontainers v0.42.0 introduced the migration to Moby modules. As a result:
github.com/moby/mobyhas replacedgithub.com/docker/dockeras its Docker client dependency path, which lead tovendor/churntest_utils.goscript/cibuildreturns with no formatting errors, build errors or unit test errors.