chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd [v1.43] - #5101
Merged
Merged
Conversation
…rable containerd [v1.43] Helm v3.21.3 drops its dependency on github.com/containerd/containerd, so the operator no longer pulls it in. go mod tidy removes containerd, errdefs, log, and platforms from the module graph. The binary buildinfo now has no containerd entry, which clears the gumball hashrelease scan flags. Also floors oras.land/oras-go/v2 to v2.6.2 for CVE-2026-50163. Cleared: - GO-2026-5338 / CVE-2026-50195 (containerd, crit 9.9) - GO-2026-5064 / CVE-2026-53492 (containerd, crit 9.6) - CVE-2026-53489 / GO-2026-5622 (containerd, high) - CVE-2026-50163 (oras-go, high 7.1) Part of EV-6408.
Member
Author
|
companion master PR: #5100 |
3 tasks
rene-dekker
approved these changes
Jul 23, 2026
pasanw
added a commit
to pasanw/operator
that referenced
this pull request
Aug 7, 2026
Mirrors the master/release-v1.43 fix (tigera#5100 / tigera#5101) for the release-v1.40 line. All three deps are indirect; no operator code changes. - helm.sh/helm/v3 v3.20.2 -> v3.21.3: the operator never imports github.com/containerd/containerd itself; it only pulled it in transitively through helm. Helm v3.21.3 drops that dependency, so the vulnerable containerd code stops shipping in the operator binary -- clearing CVE-2026-50195 (crit 9.9), CVE-2026-53492 (crit 9.6) and CVE-2026-53489 (high), none of which has a fix in the containerd 1.7.x line. This bump pulls k8s.io/* v0.35 -> v0.36 with it (same shape as a prior k8s bump on this branch). - sigs.k8s.io/controller-runtime v0.23.3 -> v0.24.1: required for k8s v0.36 compatibility (matches release-v1.43); no operator code changes. - oras.land/oras-go/v2 v2.6.0 -> v2.6.2: clears CVE-2026-50151 and CVE-2026-50163 (both confirmed fixed in v2.6.2 by OSV / the GitHub Advisory DB). An earlier attempt stopped at v2.6.1, which cleared only CVE-2026-50151. - google.golang.org/grpc -> v1.82.1: clears GHSA-hrxh-6v49-42gf / GO-2026-6061. The oras and grpc requires carry advisory-naming comments so a future re-tidy cannot silently revert the pins. Supersedes the autoclosed Renovate security PRs tigera#5092 (grpc) and tigera#5011 (oras v2.6.1). Note: Renovate keys vulnerability alerts off the default branch, so release-branch security PRs autoclose when master is fixed -- this branch's containerd exposure would otherwise be invisible to automation post-merge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
3 tasks
pasanw
added a commit
to pasanw/operator
that referenced
this pull request
Aug 7, 2026
Indirect dependency bumps only; no operator code changes, no k8s change. - oras.land/oras-go/v2 v2.6.0 -> v2.6.2: clears CVE-2026-50151 and CVE-2026-50163 (oras hardlink path traversal, high 7.1). Both are recorded as fixed = 2.6.2 by OSV and the GitHub Advisory DB, and by the master / release-v1.43 fixes (tigera#5100 / tigera#5101). (An earlier version of this PR stopped at v2.6.1 and wrongly stated v2.6.2 was not the fix.) - google.golang.org/grpc -> v1.82.1: clears GHSA-hrxh-6v49-42gf / GO-2026-6061. Both requires carry advisory-naming comments so a future go mod tidy cannot silently revert the pins. NOT fixed here, deliberately: the containerd advisories CVE-2026-50195 (crit 9.9), CVE-2026-53492 (crit 9.6) and CVE-2026-53489 (high). containerd 1.7.33 has no fixed version; the only remediation is dropping the (purely transitive, via Helm) dependency by bumping Helm to v3.21.3 -- but every containerd-free Helm is already on k8s v0.36, and this branch is kept on k8s v0.35 to stay aligned with the calico-private core (also on k8s 1.35), avoiding an operator/core minor-version divergence. These three are VEXed on this line; master and release-v1.43, already on k8s 1.36, take the Helm route (tigera#5100 / tigera#5101). Supersedes the autoclosed Renovate security PRs tigera#5092 (grpc) and tigera#5011 (oras v2.6.1). Renovate keys vulnerability alerts off the default branch, so release-branch security PRs autoclose when master is fixed -- this branch's exposure would otherwise be invisible to automation post-merge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This is the
release-v1.43backport of the master helm/oras bump. It's the operator branch that ships with Calico Enterprise v3.24-1, and the gumball hashrelease scan flagged these CVEs.Helm v3.21.3 dropped its dependency on
github.com/containerd/containerd. The operator only ever pulled containerd in throughhelm.sh/helm/v3, so bumping helm and runninggo mod tidydrops containerd from the module graph for good.go mod tidyalso removedcontainerd/errdefs,containerd/log, andcontainerd/platforms. The built binary now has no containerd entry at all, so scanners stop flagging it.This also floors
oras.land/oras-go/v2to v2.6.2 for CVE-2026-50163.Cleared CVEs:
Components affected: the operator image only. This is a dependency bump, no code change.
Part of EV-6408 (CVE rotation epic).
Companion master PR forthcoming (a sibling change opens it against
master; will cross-link here once it lands).Release Note
Test plan
Built the operator binary from the bumped branch and read its buildinfo. containerd is gone; oras and helm are at the new versions.
go.modno longer references containerd at all (dropped bygo mod tidy).Render unit tests pass:
For PR author
make gen-files(n/a)make gen-versions(n/a, not a component version)