Migrate github.com/golang/protobuf to google.golang.org/protobuf [436a197]
This release drops the deprecated github.com/golang/protobuf and adopts google.golang.org/protobuf. Care was taken to ensure the release is backwards compatible (thanks @jbduncan !). Please open an issue if you run into one.
Migrate github.com/golang/protobuf to google.golang.org/protobuf [436a197]
This release drops the deprecated github.com/golang/protobuf and adopts google.golang.org/protobuf. Care was taken to ensure the release is backwards compatible (thanks @jbduncan !). Please open an issue if you run into one.
Unfortunately, there are also breaking changes in this release:
The type of Metadata.Tools has changed from *[]Tool to *ToolsChoice, to facilitate the deprecation of Tool in the spec
ToolsChoice holds both legacy *[]Tool, as well as the new *[]Component and *[]Service fields
The Tool type, as well as the ToolsChoice.Tools field are marked as deprecated
During encoding and decoding, it is asserted that only one of both options can be present, in accordance with the "One of" constraint of the spec
When encoding to lower spec versions than v1.5 (using EncodeVersion), Components and Services are automatically converted to legacy Tools
It is strongly recommended to use Components and Services. However, when consuming BOMs, applications should still expect legacy Tools to be present, and handle them accordingly.
Changelog
Fixes
64eb0c84b3d909db47c5154c17d075f68b0c85ae: fix: remove format linters that require extra tooling (@nscuro)
Building and Packaging
696aa66151e800a672c9ec860f30d8716ae6a025: build(deps): bump actions/checkout from 3.5.3 to 4.1.0 (@dependabot[bot])
b50b319d1580d5b624cfc866bc108b589b328157: build(deps): bump actions/checkout from 4.1.0 to 4.1.1 (@dependabot[bot])
5cad1b0a7dad106950790fad960be5f7e62b2110: build(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (@dependabot[bot])
b0910619560e5b0b0fae51dc97c4a343983873fb: build(deps): bump gitpod/workspace-go from d3603c7 to 94ae638 (@dependabot[bot])
9e310b6d641245c89aa01f07a21b50c38f04b087: build(deps): bump gitpod/workspace-go from f37c673 to d3603c7 (@dependabot[bot])
89494fd98291ca8115e02cab78e2e47360352f00: build(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 (@dependabot[bot])
Others
61dd91e0bbe730454bef42bc0c1b0a3f97411c02: feat(spec1-5): add support for machine learning (@nscuro)
f831960f0887c1f60681924e4d4382cd4bb52ff0: feat(spec1-5): update valid-vulnerability test snapshots (@nscuro)
ffc9a4eb9204f5a31b7fb1d6cd907e6cc3e93578: ci: enable more linters (@mmorel-35)
This document details the versioning and release plan for containerd. Stability
is a top goal for this project, and we hope that this document and the processes
it entails will help to achieve that. It covers the release process, versioning
numbering, backporting, API stability and support horizons.
If you rely on containerd, it would be good to spend time understanding the
areas of the API that are and are not supported and how they impact your
project in the future.
This document will be considered a living document. Supported timelines,
backport targets and API stability guarantees will be updated here as they
change.
If there is something that you require or this document leaves out, please
reach out by filing an issue.
Releases
Releases of containerd will be versioned using dotted triples, similar to
Semantic Version. For the purposes of this document, we
will refer to the respective components of this triple as
<major>.<minor>.<patch>. The version number may have additional information,
such as alpha, beta and release candidate qualifications. Such releases will be
considered "pre-releases".
Major and Minor Releases
Major and minor releases of containerd will be made from main. Releases of
containerd will be marked with GPG signed tags and announced at
https://github.com/containerd/containerd/releases. The tag will be of the
format v<major>.<minor>.<patch> and should be made with the command git tag -s v<major>.<minor>.<patch>.
After a minor release, a branch will be created, with the format
release/<major>.<minor> from the minor tag. All further patch releases will
be done from that branch. For example, once we release v1.0.0, a branch
release/1.0 will be created from that tag. All future patch releases will be
done against that branch.
Pre-releases
Pre-releases, such as alphas, betas and release candidates will be conducted
from their source branch. For major and minor releases, these releases will be
done from main. For patch releases, these pre-releases should be done within
the corresponding release branch.
While pre-releases are done to assist in the stabilization process, no
guarantees are provided.
... (truncated)
Commits
64b8a81 Merge pull request #9491 from dmcgowan/prepare-1.7.11
ea5a477 Merge pull request #9352 from thaJeztah/1.7_update_golang_1.20.11
67d356c Merge pull request from GHSA-7ww5-4wqc-m92c
Bumps the go-modules group with 40 updates:
1.30.01.32.00.18.00.18.20.7.20.8.00.11.40.12.20.0.0-20230412183729-8602f1afc5740.0.11.0.61.1.04.2.14.3.01.7.101.7.110.5.00.6.026.0.0+incompatible26.0.1+incompatible0.8.00.8.10.4.00.5.05.10.15.12.01.5.31.5.40.17.00.19.11.4.01.6.01.17.41.17.80.0.0-20230301153543-ba94b245509b0.1.01.1.101.1.124.1.194.1.210.4.40.4.70.2.00.3.01.3.11.3.2-0.20230802210424-5b0b94c5c0d33.23.113.24.31.2.11.2.22.15.02.16.00.26.00.30.00.5.110.5.120.0.0-20230301185719-21920a456ad50.0.0-20230925121702-07e42b3cdba01.2.31.2.40.17.00.21.00.0.0-20230510235704-dd950f8aeaea0.0.0-20231006140011-7918f672742d0.14.00.16.00.19.00.22.00.5.00.6.00.16.00.18.00.16.00.16.10.0.0-20231120223509-83a465c0220f0.0.0-20240123012728-ef4313101c801.59.01.62.01.31.01.33.0Updates
github.com/onsi/gomegafrom 1.30.0 to 1.32.0Release notes
Sourced from github.com/onsi/gomega's releases.
Changelog
Sourced from github.com/onsi/gomega's changelog.
Commits
4379951v1.32.0a350b95Maintain source backwards compatibilitya6c8875Fix failing test436a197Migrate github.com/golang/protobuf to google.golang.org/protobuf32ef35echore: test with Go 1.22 (#733)a0d0387Bump golang.org/x/net from 0.19.0 to 0.20.0 (#717)b71e477Bump github-pages and jekyll-feed in /docs (#732)f460154docs: fix typo and broken anchor link to gstructa2862e4docs: fix HaveEach matcher signature762b171v1.31.1Updates
github.com/paketo-buildpacks/occamfrom 0.18.0 to 0.18.2Release notes
Sourced from github.com/paketo-buildpacks/occam's releases.
Commits
f37d228Bump github.com/opencontainers/runc from 1.1.5 to 1.1.121d68391tests: adding tests for NewContainerFromInspectOutput function13e5704fix: avoid accessing undefined host ports on while creating a new container f...0fb0353Bump github.com/containerd/containerd from 1.7.7 to 1.7.11Updates
github.com/CycloneDX/cyclonedx-gofrom 0.7.2 to 0.8.0Release notes
Sourced from github.com/CycloneDX/cyclonedx-go's releases.
Commits
b9654aeMerge pull request #90 from CycloneDX/spec-v1.564eb0c8fix: remove format linters that require extra toolingc7a84acfeat(spec1-5): handle deprecation of toolsf856daafeat(spec1-5): add support for formulation2fbde0efeat(spec1-5): add support for identity, occurrences, and callstack evidence61dd91efeat(spec1-5): add support for machine learningf831960feat(spec1-5): updatevalid-vulnerabilitytest snapshotsfe3a904feat(spec1-5): add support for ssvc scoring method7d2713ffeat(spec1-5): add support for vulnerability proof of concept2ae5445feat(spec1-5): add support for additional compositions and composition identityUpdates
github.com/Microsoft/hcsshimfrom 0.11.4 to 0.12.2Release notes
Sourced from github.com/Microsoft/hcsshim's releases.
... (truncated)
Commits
ad1ccf5fix: move permissions to the correct job (#2080) (#2081)6588c1cUpdating permissions and github release action versions (#2078) (#2079)202f90aAdd spans and drop large size high volume trace logsfe8c673updatenewBinaryCmdURL path handling (#2041)85086d7Upgrade to go1.21 + fix lint errors8039310[deps] Omni-bus dependency update (#2039)7458e58Update Cmd IO handling (#1937)5f9910aFix CodeQL pipeline failure (#2032)c56a09cMerge pull request #1998 from yyatmsft/removeInternalTests2c767380Don't create container scratch per base layer (#2002)Updates
github.com/anchore/stereoscopefrom 0.0.0-20230412183729-8602f1afc574 to 0.0.1Release notes
Sourced from github.com/anchore/stereoscope's releases.
Commits
Updates
github.com/andybalholm/brotlifrom 1.0.6 to 1.1.0Commits
17e5901Make my matchfinder work more accessible.cf812c0matchfinder: add M01b6cf36matchfinder: remove MultiHash265f3afmatchfinder: penalize score for overlapping matchesa8d524amatchfinder: replace Score function with DistanceBitCost578645ematchfinder: add MultiHash24b2bfamatchfinder.M4: add Score function4a024e3matchfinder.M4: add match chain3a1c5cdFix typo in comment.0d2aef3matchfinder.M4: factor out extendMatch2Updates
github.com/cenkalti/backoff/v4from 4.2.1 to 4.3.0Commits
720b789remove travis badge from readmea83af7ffeat(backoff): Add functional options for ExponentialBackOff Closes #136Updates
github.com/containerd/containerdfrom 1.7.10 to 1.7.11Release notes
Sourced from github.com/containerd/containerd's releases.
... (truncated)
Changelog
Sourced from github.com/containerd/containerd's changelog.
... (truncated)
Commits
64b8a81Merge pull request #9491 from dmcgowan/prepare-1.7.11ea5a477Merge pull request #9352 from thaJeztah/1.7_update_golang_1.20.1167d356cMerge pull request from GHSA-7ww5-4wqc-m92cdfae68bPrepare release notes for v1.7.11de6d8a8Merge pull request #9482 from ambarve/sn_cleanup_1.7ed7c689Don't block snapshot garbage collection on Remove failures467de56Merge pull request #9481 from ruiwen-zhao/cri-ud94f8ffMerge pull request #9483 from dmcgowan/backport-1.7-fix-otel-http1fdefddAdd warning for CRIU config usage8e06899Merge pull request #9479 from ruiwen-zhao/cri-api-warningUpdates
github.com/distribution/referencefrom 0.5.0 to 0.6.0Release notes
Sourced from github.com/distribution/reference's releases.
Commits
ff14fafMerge pull request #9 from ozairasim/exclude-domain-from-name-length-validation2a66312Merge pull request #10 from xrstf/patch-1094e717fix typo in readmeaaca75eExclude domain from name length check8507c7fMerge pull request #7 from thaJeztah/cleanup_splitDockerDomain89ee7ecrefactor splitDockerDomain to include more documentationa3fb784Merge pull request #5 from thaJeztah/rm_deprecated4894124remove deprecated SplitHostnameUpdates
github.com/docker/clifrom 26.0.0+incompatible to 26.0.1+incompatibleCommits
d260a54Merge pull request #5007 from vvoland/vendor-docker3369ffevendor: github.com/docker/docker v26.0.1-dev (60b9add796ae)3cf84fbMerge pull request #5006 from vvoland/v26.0-5005b1b03b3cli-bin/windows: Add .exe extension57d2fbbMerge pull request #4999 from thaJeztah/26.0_backport_bump_x_netc33cc92vendor: golang.org/x/net v0.23.0156e20cvendor: golang.org/x/net v0.22.0, golang.org/x/crypto v0.21.07522a62vendor: golang.org/x/term v0.18.0073e4e8vendor: golang.org/x/sys v0.18.06d46ff7Merge pull request #4987 from vvoland/v26.0-4986Updates
github.com/docker/docker-credential-helpersfrom 0.8.0 to 0.8.1Release notes
Sourced from github.com/docker/docker-credential-helpers's releases.
Commits
292722bMerge pull request #308 from thaJeztah/update_golang_1.21.6979dcc4Merge pull request #309 from thaJeztah/update_golangcif411a65Dockerfile: update golangci-lint to v1.55.29629bd7update to go1.21.6f642c26Merge pull request #306 from thaJeztah/err_checks8fc3306Merge pull request #307 from thaJeztah/bump_wincred6a3e64cmove trimming whitespace to error-check helpers218f178vendor: github.com/danieljoos/wincred v1.2.1Updates
github.com/docker/go-connectionsfrom 0.4.0 to 0.5.0Commits
fa09c95Merge pull request #108 from thaJeztah/carry_67a67a58Swap CloseRead and CloseWrite481d3d2Merge pull request #107 from thaJeztah/drop_legacy_go9548f9ftlsconfig: remove deprecated io/ioutilc564c21drop support for go1.17 and older7cbebcfgha: update actions2cf423ftlsconfig: move allTLSVersions vardca283btlsconfig: drop support for go1.12 and older21876c5tlsconfig: drop support for go1.6 and older4d174dbtlsconfig: drop support for go1.4 and olderUpdates
github.com/go-git/go-git/v5from 5.10.1 to 5.12.0Release notes
Sourced from github.com/go-git/go-git/v5's releases.
... (truncated)
Commits
302dddeMerge pull request #1060 from go-git/dependabot/go_modules/github.com/gliderl...6bba34dbuild: bump github.com/gliderlabs/ssh from 0.3.6 to 0.3.7feaeb36Merge pull request #937 from matejrisek/feature/rename-short-fields7959a42Merge pull request #1052 from go-git/dependabot/go_modules/github.com/skeema/...4c17ce7build: bump github.com/skeema/knownhosts from 1.2.1 to 1.2.23f77e6fMerge pull request #1048 from pjbgf/fix-reset-validation6af38e0Merge pull request #1047 from avoidalone/mastere6c3e58Looks like these dependencies are updatable in another way, so this is no longer needed.