fix(deps): vuln major upgrades — 12 packages (major: 1 · minor: 10 · patch: 1)

go.mod

@@ -1,8 +1,6 @@
 module github.com/DataDog/rules_oci
 
-go 1.24.0
-
-toolchain go1.24.2
+go 1.26.3
 
 require (
 	github.com/DataDog/zstd v1.5.7
@@ -15,52 +13,52 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/sethvargo/go-retry v0.3.0
-	github.com/sirupsen/logrus v1.9.3
+	github.com/sirupsen/logrus v1.9.4
 	github.com/stretchr/testify v1.11.1
-	github.com/urfave/cli/v2 v2.27.2
-	golang.org/x/sync v0.17.0
+	github.com/urfave/cli/v3 v3.10.1
+	golang.org/x/sync v0.22.0
 	oras.land/oras-go v1.2.7
 )
 
 require (
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
-	github.com/Microsoft/hcsshim v0.12.3 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
+	github.com/Microsoft/hcsshim v0.15.0-rc.1 // indirect
 	github.com/bazelbuild/buildtools v0.0.0-20240918101019-be1c24cc9a44 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/containerd/errdefs v0.3.0 // indirect
-	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/containerd/containerd/v2 v2.3.3 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/platforms v1.0.0-rc.4 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v28.5.1+incompatible // indirect
+	github.com/docker/cli v29.2.0+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker v28.5.1+incompatible // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
-	github.com/kr/text v0.2.0 // indirect
+	github.com/klauspost/compress v1.19.0 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.20.5 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.60.1 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 // indirect
-	go.opentelemetry.io/otel v1.32.0 // indirect
-	go.opentelemetry.io/otel/metric v1.32.0 // indirect
-	go.opentelemetry.io/otel/trace v1.32.0 // indirect
-	golang.org/x/sys v0.37.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 // indirect
-	google.golang.org/grpc v1.68.0 // indirect
-	google.golang.org/protobuf v1.35.2 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.19.2 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go/cmd/ocitool/appendlayer_cmd.go

@@ -16,12 +16,12 @@ import (
 	"github.com/DataDog/rules_oci/go/pkg/layer"
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
 
-	"github.com/containerd/containerd/images"
-	"github.com/containerd/containerd/platforms"
+	"github.com/containerd/containerd/v2/images"
+	"github.com/containerd/containerd/v2/platforms"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	log "github.com/sirupsen/logrus"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 func loadStamp(r io.Reader) (map[string]string, error) {

go/cmd/ocitool/config_cmd.go

@@ -4,10 +4,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
-	"github.com/containerd/containerd/images"
-	"github.com/containerd/containerd/platforms"
+	"github.com/containerd/containerd/v2/images"
+	"github.com/containerd/containerd/v2/platforms"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	"os"
 )
 

go/cmd/ocitool/createlayer_cmd.go

@@ -19,7 +19,7 @@ import (
 	"github.com/DataDog/zstd"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 const zstdWorkers = 8

go/cmd/ocitool/desc_helpers.go

@@ -7,7 +7,7 @@ import (
 	"github.com/DataDog/rules_oci/go/pkg/blob"
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
 
-	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/v2/content"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 

go/cmd/ocitool/digest_cmd.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
 
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 func DigestCmd(c *cli.Context) error {

go/cmd/ocitool/gen_cmd.go

@@ -9,11 +9,11 @@ import (
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
 
 	"github.com/bazelbuild/bazel-gazelle/rule"
-	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/v2/images"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	log "github.com/sirupsen/logrus"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	orascontent "oras.land/oras-go/pkg/content"
 )
 

go/cmd/ocitool/imagelayout_cmd.go

@@ -8,9 +8,9 @@ import (
 
 	"github.com/DataDog/rules_oci/go/pkg/blob"
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
-	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/v2/images"
 	"github.com/opencontainers/go-digest"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 // Given a slice of layoutFilePaths, where each path contains a file that may

go/cmd/ocitool/index_cmd.go

@@ -10,7 +10,7 @@ import (
 	ocispecv "github.com/opencontainers/image-spec/specs-go"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	log "github.com/sirupsen/logrus"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 func CreateIndexCmd(c *cli.Context) error {

go/cmd/ocitool/main.go

@@ -3,7 +3,7 @@ package main
 import (
 	"github.com/DataDog/rules_oci/go/internal/flagutil"
 	log "github.com/sirupsen/logrus"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 var app = &cli.App{

go/cmd/ocitool/manifest_cmd.go

@@ -9,7 +9,7 @@ import (
 	ocispecv "github.com/opencontainers/image-spec/specs-go"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	log "github.com/sirupsen/logrus"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 func CreateImageManifestCmd(c *cli.Context) error {

go/cmd/ocitool/publishrules_cmd.go

@@ -7,7 +7,7 @@ import (
 
 	ocispecv "github.com/opencontainers/image-spec/specs-go"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 func PublishRulesCmd(c *cli.Context) error {

go/cmd/ocitool/pull_cmd.go

@@ -5,10 +5,10 @@ import (
 
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
 
-	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/v2/images"
 	"github.com/containerd/log"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	orascontent "oras.land/oras-go/pkg/content"
 )
 

go/cmd/ocitool/push_cmd.go

@@ -6,9 +6,9 @@ import (
 	"github.com/DataDog/rules_oci/go/internal/flagutil"
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
 
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/images"
-	"github.com/urfave/cli/v2"
+	"github.com/containerd/containerd/v2/content"
+	"github.com/containerd/containerd/v2/images"
+	"github.com/urfave/cli/v3"
 )
 
 func PushCmd(c *cli.Context) error {

go/cmd/ocitool/pushblob_cmd.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
 
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 func PushBlobCmd(c *cli.Context) error {

go/pkg/blob/blobindex.go

@@ -8,8 +8,8 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/v2/content"
+	"github.com/containerd/containerd/v2/errdefs"
 	"github.com/opencontainers/go-digest"
 
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

go/pkg/credhelper/docker.go

@@ -9,8 +9,8 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/containerd/containerd/errdefs"
-	"github.com/containerd/containerd/remotes/docker"
+	"github.com/containerd/containerd/v2/errdefs"
+	"github.com/containerd/containerd/v2/remotes/docker"
 	helperclient "github.com/docker/docker-credential-helpers/client"
 	"github.com/mitchellh/go-homedir"
 	log "github.com/sirupsen/logrus"

go/pkg/layer/append.go

@@ -7,9 +7,9 @@ import (
 
 	"github.com/DataDog/rules_oci/go/pkg/ociutil"
 
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/images/converter"
-	dreference "github.com/containerd/containerd/reference/docker"
+	"github.com/containerd/containerd/v2/content"
+	"github.com/containerd/containerd/v2/images/converter"
+	dreference "github.com/containerd/containerd/v2/reference/docker"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )

go/pkg/layer/appendlayeringester.go

@@ -6,9 +6,9 @@ import (
 	"os"
 	"sync"
 
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
-	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/v2/content"
+	"github.com/containerd/containerd/v2/errdefs"
+	"github.com/containerd/containerd/v2/images"
 	"github.com/opencontainers/go-digest"
 )
 

go/pkg/ociutil/bazel.go

@@ -10,8 +10,8 @@ import (
 	"sync"
 
 	"github.com/bazelbuild/bazel-gazelle/rule"
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/v2/content"
+	"github.com/containerd/containerd/v2/images"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )

go/pkg/ociutil/desc.go

@@ -7,7 +7,7 @@ import (
 	"io"
 	"os"
 
-	dref "github.com/containerd/containerd/reference/docker"
+	dref "github.com/containerd/containerd/v2/reference/docker"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )

go/pkg/ociutil/diff.go

@@ -7,7 +7,7 @@ import (
 	"io"
 
 	"github.com/DataDog/zstd"
-	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/v2/content"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )

go/pkg/ociutil/fetch.go

@@ -1,8 +1,8 @@
 package ociutil
 
 import (
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/remotes"
+	"github.com/containerd/containerd/v2/content"
+	"github.com/containerd/containerd/v2/remotes"
 	log "github.com/sirupsen/logrus"
 	"oras.land/oras-go/pkg/oras"
 )

go/pkg/ociutil/fs.go

@@ -6,7 +6,7 @@ import (
 	"io/fs"
 	"sync"
 
-	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/v2/content"
 
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )

go/pkg/ociutil/handler.go

@@ -5,8 +5,8 @@ import (
 
 	"github.com/DataDog/rules_oci/go/internal/set"
 
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/v2/content"
+	"github.com/containerd/containerd/v2/images"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 

go/pkg/ociutil/image.go

@@ -3,7 +3,7 @@ package ociutil
 import (
 	"context"
 
-	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/v2/content"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 

go/pkg/ociutil/json.go

@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/remotes"
+	"github.com/containerd/containerd/v2/content"
+	"github.com/containerd/containerd/v2/remotes"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )

go/pkg/ociutil/manifest.go

@@ -3,7 +3,7 @@ package ociutil
 import (
 	"fmt"
 
-	"github.com/containerd/containerd/platforms"
+	"github.com/containerd/containerd/v2/platforms"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 

go/pkg/ociutil/multiprovider.go

@@ -3,8 +3,8 @@ package ociutil
 import (
 	"context"
 
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/v2/content"
+	"github.com/containerd/containerd/v2/errdefs"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )