[release-1.34] Backport for CVE-2024-3727

[danishprakash]

Bump c/image to v5.29.3, c/common to v0.57.5 to address CVE-2024-3727

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: danishprakash
Once this PR has been reviewed and has the lgtm label, please assign giuseppe for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[packit-as-a-service]

Ephemeral COPR build failed. @containers/packit-build please check.

[TomSweeneyRedHat]

@danishprakash This could be "entertaining". The definition for DefaultStoreOptions() in c/storage types changed in 1.51 from four variables passed in to zero passed in. I think if you vendored c/storage 1.51.0 in it would take care of your compile issue, but would probably cause other issues for dependencies that showed up in c/storage 1.52 and later.

I was not planning to bump v1.33 as v1.34 has the fix in it now, but could be convinced otherwise.

[nalind]

@danishprakash This could be "entertaining". The definition for DefaultStoreOptions() in c/storage types changed in 1.51 from four variables passed in to zero passed in. I think if you vendored c/storage 1.51.0 in it would take care of your compile issue, but would probably cause other issues for dependencies that showed up in c/storage 1.52 and later.

I was not planning to bump v1.33 as v1.34 has the fix in it now, but could be convinced otherwise.

Did you mean 1.35? The tip of the release-1.34 branch is currently using github.com/containers/image v5.29.1-0.20231120202631-293b00ba7166, which is from last year.

[TomSweeneyRedHat]

@nalind, you're right, but @danishprakash is also bumping c/image here to v5.29.3, which is where things get a bit wonky.

[github-actions]

A friendly reminder that this PR had no activity for 30 days.