1 Commits (bcdc807dd34d7a4e2e1dcfdffecd869da66e6efe)

Author	SHA1	Message	Date
dependabot[bot]	e9bc461c63	Bump github.com/docker/docker from 20.10.23+incompatible to 23.0.3+incompatible (#9035) ... Bumps [github.com/docker/docker](https://github.com/docker/docker) from 20.10.23+incompatible to 23.0.3+incompatible. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p> <blockquote> <h2>v23.0.3</h2> <h2>23.0.3</h2> <blockquote> <p><strong>Note</strong></p> <p>Due to an issue with CentOS 9 Stream's package repositories, packages for CentOS 9 are currently unavailable. Packages for CentOS 9 may be added later, or as part of the next (23.0.4) patch release.</p> </blockquote> <h3>Bug fixes and enhancements</h3> <ul> <li>Fixed a number of issues that can cause Swarm encrypted overlay networks to fail to uphold their guarantees, addressing <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28841">CVE-2023-28841</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28840">CVE-2023-28840</a>, and <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28842">CVE-2023-28842</a>. <ul> <li>A lack of kernel support for encrypted overlay networks now reports as an error.</li> <li>Encrypted overlay networks are eagerly set up, rather than waiting for multiple nodes to attach.</li> <li>Encrypted overlay networks are now usable on Red Hat Enterprise Linux 9 through the use of the <code>xt_bpf</code> kernel module.</li> <li>Users of Swarm overlay networks should review <a href="https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw">GHSA-vwm3-crmr-xfxw</a> to ensure that unintentional exposure has not occurred.</li> </ul> </li> </ul> <h3>Packaging Updates</h3> <ul> <li>Update containerd to <a href="https://github.com/containerd/containerd/releases/tag/v1.6.20">v1.6.20</a>.</li> <li>Update runc to <a href="https://github.com/opencontainers/runc/releases/tag/v1.1.5">v1.1.5</a>.</li> </ul> <h2>v23.0.2</h2> <h2>23.0.2</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/milestone/75?closed=1">docker/cli, 23.0.2 milestone</a></li> <li><a href="https://github.com/moby/moby/milestone/114?closed=1">moby/moby, 23.0.2 milestone</a></li> </ul> <h3>Bug fixes and enhancements</h3> <ul> <li>Fully resolve missing checks for <code>apparmor_parser</code> when an AppArmor enabled kernel is detected. <a href="https://redirect.github.com/containerd/containerd/pull/8087">containerd/containerd#8087</a>, <a href="https://redirect.github.com/moby/moby/pull/45043">moby/moby#45043</a></li> <li>Ensure that credentials are redacted from Git URLs when generating BuildKit buildinfo. Fixes <a href="https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc">CVE-2023-26054</a>. <a href="https://redirect.github.com/moby/moby/pull/45110">moby/moby#45110</a></li> <li>Fix anonymous volumes created by a <code>VOLUME</code> line in a Dockerfile being excluded from volume prune. <a href="https://redirect.github.com/moby/moby/pull/45159">moby/moby#45159</a></li> <li>Fix a failure to properly propagate errors during removal of volumes on a Swarm node. <a href="https://redirect.github.com/moby/moby/pull/45155">moby/moby#45155</a></li> <li>Temporarily work around a bug in BuildKit <code>COPY --link</code> by disabling mergeop/diffop optimization. <a href="https://redirect.github.com/moby/moby/pull/45112">moby/moby#45112</a></li> <li>Properly clean up child tasks when a parent Swarm job is removed. <a href="https://redirect.github.com/moby/swarmkit/pull/3112">moby/swarmkit#3112</a>, <a href="https://redirect.github.com/moby/moby/pull/45107">moby/moby#45107</a></li> <li>Fix Swarm service creation logic so that both a GenericResource and a non-default network can be used together. <a href="https://redirect.github.com/moby/swarmkit/pull/3082">moby/swarmkit#3082</a>, <a href="https://redirect.github.com/moby/moby/pull/45107">moby/moby#45107</a></li> <li>Fix Swarm CSI support requiring the CSI plugin to offer staging endpoints in order to publish a volume. <a href="https://redirect.github.com/moby/swarmkit/pull/3116">moby/swarmkit#3116</a>, <a href="https://redirect.github.com/moby/moby/pull/45107">moby/moby#45107</a></li> <li>Fix a panic caused by log buffering in some configurations. <a href="https://redirect.github.com/containerd/fifo/pull/47">containerd/fifo#47</a>, <a href="https://redirect.github.com/moby/moby/pull/45051">moby/moby#45051</a></li> <li>Log errors in the REST to Swarm gRPC API translation layer at the debug level to reduce redundancy and noise. <a href="https://redirect.github.com/moby/moby/pull/45016">moby/moby#45016</a></li> <li>Fix a DNS resolution issue affecting containers created with <code>--dns-opt</code> or <code>--dns-search</code> when <code>systemd-resolved</code> is used outside the container. <a href="https://redirect.github.com/moby/moby/pull/45000">moby/moby#45000</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="59118bff50"><code>59118bf</code></a> Merge pull request from GHSA-232p-vwff-86mp</li> <li><a href="219f21bf07"><code>219f21b</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/45196">#45196</a> from vvoland/integration-restart-race-23</li> <li><a href="b87f7f18b8"><code>b87f7f1</code></a> libnet/d/overlay: insert the input-drop rule</li> <li><a href="c6bf3071fe"><code>c6bf307</code></a> StartWithLogFile: Fix d.cmd race</li> <li><a href="7f49ca259b"><code>7f49ca2</code></a> TestDaemonRestartKillContainers: Fix loop capture</li> <li><a href="98cbcb8003"><code>98cbcb8</code></a> libnet/d/overlay: add BPF-powered VNI matcher</li> <li><a href="5c5fac2374"><code>5c5fac2</code></a> libnet/d/overlay: extract VNI match rule builder</li> <li><a href="c492a22287"><code>c492a22</code></a> libn/d/overlay: enforce encryption on sandbox init</li> <li><a href="018edb0284"><code>018edb0</code></a> libnet/d/overlay: document some encryption code</li> <li><a href="a1fd2f22f6"><code>a1fd2f2</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/45157">#45157</a> from thaJeztah/23.0_backport_update_shfmt</li> <li>Additional commits viewable in <a href="https://github.com/docker/docker/compare/v20.10.23...v23.0.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Michel Hollands <42814411+MichelHollands@users.noreply.github.com>	3 years ago