Bump go-containerregistry

[ystkfujii]

Fixes #

Proposed Changes

• Bump go-containerregistry
  • github.com/docker/docker v25.0.5 has a CVE-2024-41110

Trivy Scan Result

$ docker run --rm -v .:/wd -w /wd aquasec/trivy fs . -s CRITICAL
2025-02-04T16:46:30Z    INFO    [vulndb] Need to update DB
2025-02-04T16:46:30Z    INFO    [vulndb] Downloading vulnerability DB...
2025-02-04T16:46:30Z    INFO    [vulndb] Downloading artifact...        repo="mirror.gcr.io/aquasec/trivy-db:2"
175.25 KiB / 58.78 MiB [>____________________________________________________________] 0.29% ? p/s ?1.03 MiB / 58.78 MiB [->_____________________________________________________________] 1.75% ? p/s ?5.95 MiB / 58.78 MiB [------>_______________________________________________________] 10.13% ? p/s ?9.52 MiB / 58.78 MiB [------->_________________________________________] 16.19% 15.57 MiB p/s ETA 3s15.25 MiB / 58.78 MiB [------------>___________________________________] 25.95% 15.57 MiB p/s ETA 2s19.28 MiB / 58.78 MiB [--------------->________________________________] 32.81% 15.57 MiB p/s ETA 2s25.67 MiB / 58.78 MiB [-------------------->___________________________] 43.68% 16.30 MiB p/s ETA 2s32.11 MiB / 58.78 MiB [-------------------------->_____________________] 54.63% 16.30 MiB p/s ETA 1s38.53 MiB / 58.78 MiB [------------------------------->________________] 65.55% 16.30 MiB p/s ETA 1s44.97 MiB / 58.78 MiB [------------------------------------>___________] 76.51% 17.33 MiB p/s ETA 0s51.41 MiB / 58.78 MiB [----------------------------------------->______] 87.46% 17.33 MiB p/s ETA 0s57.69 MiB / 58.78 MiB [----------------------------------------------->] 98.14% 17.33 MiB p/s ETA 0s58.78 MiB / 58.78 MiB [---------------------------------------------->] 100.00% 17.69 MiB p/s ETA 0s58.78 MiB / 58.78 MiB [---------------------------------------------->] 100.00% 17.69 MiB p/s ETA 0s58.78 MiB / 58.78 MiB [---------------------------------------------->] 100.00% 17.69 MiB p/s ETA 0s58.78 MiB / 58.78 MiB [---------------------------------------------->] 100.00% 16.55 MiB p/s ETA 0s58.78 MiB / 58.78 MiB [---------------------------------------------->] 100.00% 16.55 MiB p/s ETA 0s58.78 MiB / 58.78 MiB [---------------------------------------------->] 100.00% 16.55 MiB p/s ETA 0s58.78 MiB / 58.78 MiB [-------------------------------------------------] 100.00% 16.60 MiB p/s 3.7s2025-02-04T16:46:35Z   INFO    [vulndb] Artifact successfully downloaded       repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-02-04T16:46:35Z    INFO    [vuln] Vulnerability scanning is enabled
2025-02-04T16:46:35Z    INFO    [secret] Secret scanning is enabled
2025-02-04T16:46:35Z    INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-02-04T16:46:35Z    INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.59/docs/scanner/secret#recommendation for faster secret detection
2025-02-04T16:46:39Z    WARN    [pip] Unable to find python `site-packages` directory. License detection is skipped.    err="unable to find path to Python executable"
2025-02-04T16:46:39Z    INFO    Number of language-specific files       num=2
2025-02-04T16:46:39Z    INFO    [pip] Detecting vulnerabilities...
2025-02-04T16:46:39Z    INFO    [gomod] Detecting vulnerabilities...

go.mod (gomod)
==============
Total: 1 (CRITICAL: 1)

┌──────────────────────────┬────────────────┬──────────┬────────┬──────────────────────┬─────────────────────────────────┬────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │  Installed Version   │          Fixed Version          │                   Title                    │
├──────────────────────────┼────────────────┼──────────┼────────┼──────────────────────┼─────────────────────────────────┼────────────────────────────────────────────┤
│ github.com/docker/docker │ CVE-2024-41110 │ CRITICAL │ fixed  │ v25.0.5+incompatible │ 23.0.15, 26.1.5, 27.1.1, 25.0.6 │ moby: Authz zero length regression         │
│                          │                │          │        │                      │                                 │ https://avd.aquasec.com/nvd/cve-2024-41110 │
└──────────────────────────┴────────────────┴──────────┴────────┴──────────────────────┴─────────────────────────────────┴────────────────────────────────────────────┘

Release Note

NONE

[knative-prow]

Welcome @ystkfujii! It looks like this is your first PR to knative/serving 🎉

[knative-prow]

Hi @ystkfujii. Thanks for your PR.

I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dprotaso]

note the CVE doesn't affect knative serving - but we should bump the go.mod anyway

also after updating the dependency please run ./hack/update-deps.sh

[dprotaso]

/ok-to-test

[dprotaso]

/lgtm
/approve

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dprotaso, ystkfujii

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [dprotaso]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.81%. Comparing base (6265a8e) to head (4f2ad85).
Report is 18 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #15751      +/-   ##
==========================================
- Coverage   80.84%   80.81%   -0.03%     
==========================================
  Files         222      222              
  Lines       18070    18075       +5     
==========================================
- Hits        14609    14608       -1     
- Misses       3089     3095       +6     
  Partials      372      372              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.