api: update github.com/containerd/ttrpc v1.2.5 to be aligned with containerd

[thaJeztah]

• relates to [release/1.7]: api: update github.com/containerd/ttrpc v1.2.5 to align with containerd 1.7 module #10364
• relates to vendor: github.com/containerd/ttrpc v1.2.5 #10372

api: update github.com/containerd/ttrpc v1.2.5

Update the dependency and the indirect golang.org/x/net version to align
with containerd itself, and to prevent a vulnerability being detected.

We should keep the versions <= versions used by containerd 1.7 to prevent
forcing users of containerd 1.7 in combination with the latest version
of the API module from having to update all their dependencies, but
this update should likely be fine (and aligns with 1.7).

Before this:

Scanning your code and 254 packages across 15 dependent modules for known vulnerabilities...

=== Symbol Results ===

Vulnerability #1: GO-2024-2687
    HTTP/2 CONTINUATION flood in net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2687
  Module: golang.org/x/net
    Found in: golang.org/x/[email protected]
    Fixed in: golang.org/x/[email protected]
    Example traces found:
      #1: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.ConnectionError.Error
      #2: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.ErrCode.String
      #3: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.FrameHeader.String
      #4: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.FrameType.String
      #5: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.Setting.String
      #6: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.SettingID.String
      #7: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.StreamError.Error
      #8: services/content/v1/content_ttrpc.pb.go:272:35: content.ttrpccontentClient.Write calls ttrpc.Client.NewStream, which eventually calls http2.chunkWriter.Write
      #9: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.connError.Error
      #10: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.duplicatePseudoHeaderError.Error
      #11: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.headerFieldNameError.Error
      #12: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.headerFieldValueError.Error
      #13: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.pseudoHeaderError.Error
      #14: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.writeData.String

Your code is affected by 1 vulnerability from 1 module.
This scan also found 0 vulnerabilities in packages you import and 3
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.

After this:

govulncheck ./...
Scanning your code and 251 packages across 13 dependent modules for known vulnerabilities...

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 3
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.

api: update github.com/sirupsen/logrus v1.9.3

Align with the version used by containerd itself.

We should keep the versions <= versions used by containerd 1.7 to prevent
forcing users of containerd 1.7 in combination with the latest version
of the API module from having to update all their dependencies, but
this update should likely be fine (and aligns with 1.7).

[thaJeztah]

FWIW; this one is ahead of the 1.7 api module. Not sure if problematic for 1.7 consumers, but we could (if it is) downgrade this to a lower "minimum required" version; googleapis/go-genproto@b8732ec...c3f9821

[dmcgowan]

Why is an indirect dependency bumped in a separate commit? Is that version updated manually?

[thaJeztah]

Yes, the automatic minimum version is determined through the minimum required version in the dependency graph; currently that's through ttpc, which defines the minimum version required is 1.8.1;

go mod graph | grep ' github.com/sirupsen/logrus'
github.com/containerd/containerd/api github.com/sirupsen/[email protected]
github.com/containerd/[email protected] github.com/sirupsen/[email protected]

That's the minimum required version, so it's allowed to pick any compatible version above; in this case, we know we will be using 1.9.3, because that's what any version of containerd that will use the API module already uses, but older versions of logrus had some race conditions, and versions before 1.8.3 had a potential DOS when writing large messages, so we should try to get older version out of the list.

FWIW; once / if we update ttrpc to v1.2.5 with containerd/ttrpc#169, the version will be automatically raised as containerd/logs requires v1.9.3 of logrus.

[dmcgowan]

@thaJeztah That commit should be dropped then, the api package should stay at minimums and let the binary packages be responsible for bumping versions.

[dmcgowan]

https://github.com/containerd/ttrpc/releases/tag/v1.2.5

[thaJeztah]

updated to ttrpc v1.2.5, and opened #10372 for containerd itself

[thaJeztah]

👍 looks like CRIU packages are working again; all green now PTAL