Skip to content

chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd - #5100

Merged
electricjesus merged 1 commit into
masterfrom
seth/helm-3213-oras-cve
Jul 23, 2026
Merged

chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd#5100
electricjesus merged 1 commit into
masterfrom
seth/helm-3213-oras-cve

Conversation

@electricjesus

@electricjesus electricjesus commented Jul 23, 2026

Copy link
Copy Markdown
Member

Description

This bumps Helm to v3.21.3 and floors oras-go to v2.6.2 so the vulnerable containerd code stops shipping in the operator binary.

The operator never imports github.com/containerd/containerd itself. It only pulled it in transitively through helm.sh/helm/v3. Helm v3.21.3 dropped that dependency, so once we bump Helm the whole containerd module family (containerd, errdefs, log, platforms) falls out of the build graph. That clears three containerd CVEs from the image:

The oras-go bump to v2.6.2 clears CVE-2026-50163 (high 7.1).

Only go.mod and go.sum change. Helm v3.21.3 also pulls cyphar/filepath-securejoin up to v0.7.0, which is why that line moves too. No operator code changed, so this is a pure dependency graph update.

Part of the CVE / third-party updates epic, EV-6408.

Release Note

Removed the vulnerable containerd dependency from the operator image by bumping Helm to v3.21.3, and cleared an oras-go CVE by flooring it to v2.6.2.

For PR author

  • Tests for change. (existing render unit tests exercise the changed graph)
  • If changing pkg/apis/, run make gen-files (n/a, no API change)
  • If changing versions, run make gen-versions (n/a, this is a go.mod dep, not a component version)

Test plan

Built the operator binary before and after the bump and read the embedded build info. containerd is present before and gone after.

Before (go version -m on the pre-bump binary):

dep  github.com/containerd/containerd  v1.7.33
dep  helm.sh/helm/v3                   v3.21.2
dep  oras.land/oras-go/v2              v2.6.1

After (go version -m on the post-bump binary):

dep  helm.sh/helm/v3      v3.21.3
dep  oras.land/oras-go/v2  v2.6.2

No github.com/containerd/containerd line remains in the binary. Cross-checks:

$ go version -m operator | grep 'containerd/containerd'   # (no output)
$ go list -deps ./... | grep 'github.com/containerd/containerd$'
NONE

Render unit tests pass, including the Helm-driven pkg/render/gatewayapi and pkg/render/istio packages that consume the Helm library:

$ go test ./pkg/render/...
ok  github.com/tigera/operator/pkg/render/gatewayapi  3.069s
ok  github.com/tigera/operator/pkg/render/istio       18.252s
... (all render packages ok)

@electricjesus
chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulne…
e2324ad 
…rable containerd

Helm v3.21.3 removes its dependency on github.com/containerd/containerd,
which the operator only pulled in transitively via helm.sh/helm/v3. Dropping
it clears these CVEs from the operator binary:

- GO-2026-5338 / CVE-2026-50195 (containerd checkpoint tag poisoning)
- GO-2026-5064 / CVE-2026-53492 (containerd CDI device smuggling)
- CVE-2026-53489 / GO-2026-5622 (containerd symlink log read)

Also floors oras.land/oras-go/v2 to v2.6.2 to clear CVE-2026-50163.

EV-6408
@electricjesus
electricjesus requested a review from a team as a code owner July 23, 2026 14:08
@marvin-tigera marvin-tigera added this to the v1.44.0 milestone Jul 23, 2026
@electricjesus

electricjesus commented Jul 23, 2026

Copy link
Copy Markdown
Member Author

release-v1.43 backport: #5101

@electricjesus electricjesus mentioned this pull request Jul 23, 2026
Merged
3 tasks
@electricjesus
electricjesus merged commit 3fce8ac into master Jul 23, 2026
7 checks passed
@electricjesus
electricjesus deleted the seth/helm-3213-oras-cve branch July 23, 2026 18:45
pasanw added a commit to pasanw/operator that referenced this pull request Aug 7, 2026
@pasanw @claude
[CVE] bump helm to v3.21.3 (drops containerd) and oras-go to v2.6.2
26d76ac 
Mirrors the master/release-v1.43 fix (tigera#5100 / tigera#5101) for the release-v1.40
line. All three deps are indirect; no operator code changes.

  - helm.sh/helm/v3 v3.20.2 -> v3.21.3: the operator never imports
    github.com/containerd/containerd itself; it only pulled it in
    transitively through helm. Helm v3.21.3 drops that dependency, so the
    vulnerable containerd code stops shipping in the operator binary --
    clearing CVE-2026-50195 (crit 9.9), CVE-2026-53492 (crit 9.6) and
    CVE-2026-53489 (high), none of which has a fix in the containerd 1.7.x
    line. This bump pulls k8s.io/* v0.35 -> v0.36 with it (same shape as a
    prior k8s bump on this branch).
  - sigs.k8s.io/controller-runtime v0.23.3 -> v0.24.1: required for k8s
    v0.36 compatibility (matches release-v1.43); no operator code changes.
  - oras.land/oras-go/v2 v2.6.0 -> v2.6.2: clears CVE-2026-50151 and
    CVE-2026-50163 (both confirmed fixed in v2.6.2 by OSV / the GitHub
    Advisory DB). An earlier attempt stopped at v2.6.1, which cleared only
    CVE-2026-50151.
  - google.golang.org/grpc -> v1.82.1: clears GHSA-hrxh-6v49-42gf /
    GO-2026-6061.

The oras and grpc requires carry advisory-naming comments so a future
re-tidy cannot silently revert the pins.

Supersedes the autoclosed Renovate security PRs tigera#5092 (grpc) and tigera#5011
(oras v2.6.1). Note: Renovate keys vulnerability alerts off the default
branch, so release-branch security PRs autoclose when master is fixed --
this branch's containerd exposure would otherwise be invisible to
automation post-merge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@pasanw pasanw mentioned this pull request Aug 7, 2026
Draft
3 tasks
pasanw added a commit to pasanw/operator that referenced this pull request Aug 7, 2026
@pasanw @claude
[CVE] bump oras-go to v2.6.2 and grpc to v1.82.1
276e575 
Indirect dependency bumps only; no operator code changes, no k8s change.

  - oras.land/oras-go/v2 v2.6.0 -> v2.6.2: clears CVE-2026-50151 and
    CVE-2026-50163 (oras hardlink path traversal, high 7.1). Both are
    recorded as fixed = 2.6.2 by OSV and the GitHub Advisory DB, and by the
    master / release-v1.43 fixes (tigera#5100 / tigera#5101). (An earlier version of
    this PR stopped at v2.6.1 and wrongly stated v2.6.2 was not the fix.)
  - google.golang.org/grpc -> v1.82.1: clears GHSA-hrxh-6v49-42gf /
    GO-2026-6061.

Both requires carry advisory-naming comments so a future go mod tidy
cannot silently revert the pins.

NOT fixed here, deliberately: the containerd advisories CVE-2026-50195
(crit 9.9), CVE-2026-53492 (crit 9.6) and CVE-2026-53489 (high). containerd
1.7.33 has no fixed version; the only remediation is dropping the (purely
transitive, via Helm) dependency by bumping Helm to v3.21.3 -- but every
containerd-free Helm is already on k8s v0.36, and this branch is kept on
k8s v0.35 to stay aligned with the calico-private core (also on k8s 1.35),
avoiding an operator/core minor-version divergence. These three are VEXed
on this line; master and release-v1.43, already on k8s 1.36, take the Helm
route (tigera#5100 / tigera#5101).

Supersedes the autoclosed Renovate security PRs tigera#5092 (grpc) and tigera#5011
(oras v2.6.1). Renovate keys vulnerability alerts off the default branch,
so release-branch security PRs autoclose when master is fixed -- this
branch's exposure would otherwise be invisible to automation post-merge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rene-dekker rene-dekker rene-dekker approved these changes

Assignees

No one assigned

Labels

docs-not-required release-note-required

Projects

None yet

Milestone

v1.44.0

Development

Successfully merging this pull request may close these issues.

3 participants

@electricjesus @rene-dekker @marvin-tigera